joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x70b1ec]
mov eax, dword [eax + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
cmp eax, 0xffffffff
push edi
mov dword [esp + 0x18], 0x3f800000
mov dword [esp + 0x1c], 0x3f666666
mov dword [esp + 0x20], 0x3f666666
mov dword [esp + 0x24], 0x3f666666
je 0x4a7adb
push 0xffffffffffffffff
push esi
push esi
xor edi, edi
mov word [esp + 0x1c], si
mov word [esp + 0x1e], si
mov word [esp + 0x20], 0x1e0
mov word [esp + 0x22], 0x280
call fcn.0043f2a0
add esp, 4
push eax
lea eax, [esp + 0x1c]
mov ecx, eax
call fcn.00497070
add esp, 0xc
mov ecx, dword [0x70b254]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [0x70b1ec]
mov dword [0x6dddcc], ecx
mov dword [0x6dddd8], edi
mov dword [0x6ddddc], ebx
mov dword [0x6ddde0], ebp
mov dword [0x6ddde4], edx
mov word [0x6dddd4], 0xffff
mov word [0x6dddd6], si
mov dword [0x6dddd0], esi
mov ecx, dword [eax + 0x2c]
cmp ecx, 0xffffffff
je 0x4a7b6a
mov edx, dword [0x70b1fc]
call fcn.005532a0
push eax
lea eax, [esp + 0x14]
push esi
push esi
mov ecx, eax
mov word [esp + 0x1c], 0x4e
mov word [esp + 0x1e], 0x72
mov word [esp + 0x20], 0x6e
mov word [esp + 0x22], 0x280
call fcn.005106b0
add esp, 0xc
mov ecx, dword [0x70b1ec]
mov eax, dword [ecx + 0x2c]
cmp eax, 0xffffffff
mov edx, 0x66b918
je 0x4a7bb1
mov ecx, dword [0x86cff4]
and eax, 0xffff
shl eax, 5
mov eax, dword [eax + ecx + 0x14]
cmp dword [eax], 0xe
jle 0x4a7bb1
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x118]
add ecx, 0x118
cmp eax, esi
jle 0x4a7bb1
mov edx, dword [ecx + 0xc]
shr eax, 1
mov word [edx + eax*2 - 2], si
mov eax, dword [0x70b254]
mov ecx, dword [esp + 0x24]
push edx
mov dword [0x6dddcc], eax
lea eax, [esp + 0x14]
mov dword [0x6ddde4], ecx
push esi
push esi
mov ecx, eax
mov word [esp + 0x1c], 0x19e
mov word [esp + 0x1e], si
mov word [esp + 0x20], 0x1c2
mov word [esp + 0x22], 0x276
mov dword [0x6dddd8], edi
mov dword [0x6ddddc], ebx
mov dword [0x6ddde0], ebp
mov word [0x6dddd4], 0xffff
mov word [0x6dddd6], 1
mov dword [0x6dddd0], esi
call fcn.005106b0
lea edx, [esp + 0x1c]
push edx
mov word [esp + 0x20], 0x76
mov word [esp + 0x22], 0x78
mov word [esp + 0x24], 0x8f
mov word [esp + 0x26], 0x208
call fcn.004a7860
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4c1fb0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x851c30]
mov edx, dword [ecx + 0x34]
and eax, 0xffff
lea eax, [eax + eax*2]
push ebx
push ebp
mov ebp, dword [edx + eax*4 + 8]
movsx edx, word [esp + 0x10]
lea eax, [edx + edx*2]
lea ecx, [ebp + eax*4 + 0x2b0]
mov eax, dword [ebp]
and eax, 0xffff
shl eax, 5
push esi
mov esi, dword [0x86cff4]
mov esi, dword [eax + esi + 0x14]
mov eax, edx
imul eax, eax, 0x70
push edi
mov edi, dword [esi + 0x4f4]
mov bl, byte [eax + edi]
add eax, edi
test bl, 1
je 0x4c200c
mov word [ecx + 8], 0
mov ebx, dword [ebp + 4]
cmp ebx, 1
jne 0x4c201e
mov dx, word [ebp + edx*2 + 0x2dc]
jmp 0x4c2022
mov dx, word [ecx + 6]
mov si, word [eax + 0x18]
cmp si, dx
jle 0x4c2030
movsx esi, dx
jmp 0x4c2033
movsx esi, si
mov di, word [ecx + 8]
add di, si
xor esi, esi
mov si, word [eax + 0xa]
cmp di, si
jle 0x4c2047
mov edi, esi
mov esi, dword [0x6eb3c0]
test esi, esi
jne 0x4c2075
mov dl, byte [0x86bfa2]
test dl, dl
jne 0x4c206f
test byte [ebp + 0x1f4], 2
je 0x4c206f
mov dx, word [ecx + 8]
sub dx, di
add word [ecx + 6], dx
mov si, word [ecx + 6]
jmp 0x4c20a5
xor esi, esi
cmp byte [0x86bfa2], 0
mov si, word [ecx + 6]
jne 0x4c20a5
cmp ebx, 1
je 0x4c209a
xor edx, edx
mov dx, word [ecx + 8]
sub dx, di
add esi, edx
mov word [ecx + 6], si
jmp 0x4c20a5
xor esi, esi
mov si, word [ecx + 8]
sub si, di
add esi, edx
test si, si
mov word [ecx + 8], di
mov word [ecx], 2
mov word [ecx + 2], 0
jle 0x4c20e6
cmp di, word [eax + 0xa]
jge 0x4c20e6
test byte [eax], 1
jne 0x4c20e6
test byte [ebp + 0x230], 0x26
jne 0x4c20e6
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0
push eax
push ecx
call fcn.004c1d90
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [ebp + 0x10]
pop edi
or eax, 0x4000000
pop esi
mov dword [ebp + 0x10], eax
pop ebp
pop ebx
ret
Function at 0x4c6700
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
push ecx
push 0x4c66d0
push 0x10400
push 0
mov dword [0x70b8ac], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4c6760
push 0x2710
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4c6748
push 0
push esi
call dword [sym.imp.kernel32.dll_TerminateThread]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x70b8ac]
test eax, eax
je 0x4c6760
mov eax, 1
pop esi
pop ecx
ret
mov dword [0x70b8b0], 0
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4c6890
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp edi, ebx
jne 0x4c68c3
cmp esi, ebx
jne 0x4c68c3
pop edi
pop esi
mov byte [0x70b7ba], bl
mov byte [0x70b7da], bl
mov byte [0x70b7b9], bl
mov al, 1
pop ebx
add esp, 0x1c
ret
mov eax, edi
call fcn.004da810
test al, al
je 0x4c69e1
push 8
push esi
push 0x70b7da
call fcn.0061f130
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
mov byte [0x70b7e2], bl
call fcn.004da6c0
add esp, 0x18
test al, al
je 0x4c6930
cmp byte [esp + 0x2c], bl
jne 0x4c69e1
push 0x1f
lea edx, [esp + 0x10]
push edx
push 0x70b7ba
mov byte [0x70b7b9], 1
call fcn.0061f130
add esp, 0xc
pop edi
pop esi
mov byte [0x70b7d9], bl
mov al, 1
pop ebx
add esp, 0x1c
ret
push ebx
mov eax, edi
call fcn.004da640
add esp, 4
test al, al
je 0x4c69e1
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4c6948
sub eax, edx
inc eax
push eax
push ebx
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
mov edx, esi
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4c6962
call fcn.00496bc0
call fcn.00495e40
cmp edi, ebx
mov dword [0x70ae2c], 3
jne 0x4c698d
mov word [0x6ac6d0], bx
jmp 0x4c699c
push 0x40
mov eax, 0x6ac6d0
call fcn.00553370
add esp, 4
cmp dword [0x70b8a8], ebx
je 0x4c69bb
mov edi, dword [sym.imp.kernel32.dll_Sleep]
lea ebx, [ebx]
push ebx
call edi
cmp dword [0x70b8a8], ebx
jne 0x4c69b0
lea eax, [esp + 0x2c]
push eax
push ebx
push esi
push 0x4c6770
push 0x4000
push ebx
call dword [sym.imp.kernel32.dll_CreateThread]
pop edi
pop esi
mov dword [0x70b8a8], eax
mov al, 1
pop ebx
add esp, 0x1c
ret
push ebx
push ebx
call fcn.004c6890
push ebx
push 1
push 0xffffffffffffffff
push 0x35
call fcn.00497470
add esp, 0x18
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x1c
ret
Function at 0x4cb3b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push edi
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
call esi
call fcn.0061f76f
mov edx, dword [esp + 0x14]
push 0
push 0x3e8
mov ebx, eax
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.006292c0
mov esi, dword [0x6a60a4]
mov edi, dword [0x6a60a0]
push esi
push edi
push edx
push eax
call fcn.00634420
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push esi
push edi
push ecx
push edx
mov ebp, eax
call fcn.00634420
pop edi
xor ebp, eax
xor ebx, ebp
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret

Function at 0x4ce610
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x70ba20]
test al, al
jne 0x4ce62a
mov edx, 0x6b11a0
call fcn.004ce670
mov byte [0x70ba20], 1
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
jle 0x4ce65c
mov edx, dword [esp + 0x10]
mov edi, edi
xor ecx, ecx
mov cl, byte [edx]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6b11a0]
shr eax, 8
inc edx
xor eax, ecx
dec esi
jne 0x4ce640
mov dword [edi], eax
pop edi
pop esi
ret

Function at 0x4ce670
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
xor ecx, ecx
mov edi, 0x100
lea esp, [esp]
mov eax, ecx
mov esi, 8
test al, 1
je 0x4ce694
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ce696
shr eax, 1
dec esi
jne 0x4ce687
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x4ce680
pop edi
pop esi
ret
Function at 0x4d8a90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov al, byte [ebx + 0xfe]
sub esp, 0xc
test al, 2
je 0x4d8aac
cmp word [ebx + 0xf6], 0x10
mov byte [esp + 3], 1
jl 0x4d8ab1
mov byte [esp + 3], 0
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea esi, [edi + 0x18]
mov ebp, 9
mov al, byte [esi + 0xb5]
test al, al
je 0x4d8b09
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0x3e8
push ecx
push edx
call fcn.006292c0
mov ecx, dword [0x6a60a4]
push ecx
mov ecx, dword [0x6a60a0]
push ecx
push edx
push eax
call fcn.00634420
sub eax, dword [esi]
cmp eax, 0x1770
jle 0x4d8b19
mov ecx, 0x34
xor eax, eax
lea edi, [esi - 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
add esi, 0xd0
dec ebp
jne 0x4d8ac0
mov edx, dword [ebx]
xor eax, eax
mov ecx, edi
cmp edx, dword [ecx]
je 0x4d8b7f
inc eax
add ecx, 0xd0
cmp eax, 9
jl 0x4d8b28
xor eax, eax
mov ecx, edi
lea esp, [esp]
mov dl, byte [ecx + 0xcd]
test dl, dl
je 0x4d8b7f
inc eax
add ecx, 0xd0
cmp eax, 9
jl 0x4d8b40
mov al, byte [esp + 0xf]
test al, al
je 0x4d8b76
xor eax, eax
mov cl, byte [edi + 0xcc]
test cl, cl
je 0x4d8b83
inc eax
add edi, 0xd0
cmp eax, 9
jl 0x4d8b60
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xc
ret
mov ebp, ecx
jmp 0x4d8b8e
mov ecx, 0x34
xor eax, eax
mov ebp, edi
rep stosd dword es:[edi], eax
mov byte [ebp + 0xcd], 1
mov edx, ebx
mov ecx, dword [edx]
mov eax, ebp
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov edx, dword [edx + 0x14]
mov dword [eax + 0x14], edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0x3e8
push ecx
push edx
call fcn.006292c0
mov ecx, dword [0x6a60a4]
push ecx
mov ecx, dword [0x6a60a0]
push ecx
push edx
push eax
call fcn.00634420
mov dword [ebp + 0x18], eax
mov dx, word [ebx + 0x1c]
lea eax, [ebx + 0x1e]
mov word [ebp + 0xca], dx
cmp word [eax], 0
push 0xf
je 0x4d8c11
push eax
lea eax, [ebp + 0x1c]
push eax
jmp 0x4d8c1a
push 0x66453c
lea ecx, [ebp + 0x1c]
push ecx
call fcn.00622e84
mov word [ebp + 0x3a], 0
mov dx, word [ebx + 0xf4]
mov word [ebp + 0xc0], dx
lea esi, [ebx + 0x70]
lea edi, [ebp + 0x3c]
mov ecx, 0x21
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebx + 0xf6]
mov word [ebp + 0xc2], ax
mov cx, word [ebx + 0xf8]
mov word [ebp + 0xc4], cx
mov dx, word [ebx + 0xfa]
mov cl, byte [esp + 0x1b]
mov word [ebp + 0xc6], dx
mov ax, word [ebx + 0xfc]
mov word [ebp + 0xc8], ax
mov byte [ebp + 0xcc], cl
mov dl, byte [ebx + 0xfe]
shr dl, 2
and dl, 1
add esp, 0xc
cmp word [ebp + 0xc0], 3
mov byte [ebp + 0xce], dl
jne 0x4d8cbc
test byte [ebx + 0xfe], 8
je 0x4d8cbc
pop edi
mov eax, 1
pop esi
mov byte [ebp + 0xcf], al
pop ebp
add esp, 0xc
ret
pop edi
xor eax, eax
mov byte [ebp + 0xcf], al
pop esi
mov al, 1
pop ebp
add esp, 0xc
ret
Function at 0x4de6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x73
mov byte [esp + 2], cl
mov byte [esp + 3], cl
mov cl, 0x20
mov dl, 0x61
mov byte [esp + 7], cl
mov byte [esp + 0xc], cl
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov dword [eax], 0
mov byte [esp], 0x6d
mov byte [esp + 1], 0x65
mov ecx, dword [esp]
mov byte [esp + 4], dl
mov dword [eax], ecx
mov byte [esp + 5], 0x67
mov byte [esp + 6], 0x65
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6e
mov ecx, dword [esp + 8]
mov byte [esp + 0xd], 0x62
mov byte [esp + 0xe], 0x6f
mov byte [esp + 0xf], 0x74
mov edx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
add esp, 0x14
ret

Function at 0x4df4a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
lea eax, [esp + 4]
push eax
call esi
mov ecx, dword [esp + 0x10]
mov dl, byte [ecx + 6]
shr dl, 2
test dl, 1
je 0x4df511
lea eax, [esp + 4]
push eax
call esi
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push 0x3e8
push ecx
push edx
call fcn.006292c0
mov ecx, dword [0x6a60a4]
push ecx
mov ecx, dword [0x6a60a0]
push ecx
push edx
push eax
call fcn.00634420
mov ecx, dword [0x70e038]
mov esi, eax
mov edx, esi
sub edx, ecx
cmp edx, 0x3a98
jbe 0x4df511
call fcn.004e0b50
mov dword [0x70e038], esi
mov al, 1
pop esi
add esp, 8
ret
Function at 0x4e8500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
xor ebx, ebx
push esi
mov esi, eax
push edi
xor eax, eax
mov byte [esp + 0x20], bl
mov ecx, 0x24
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xbc]
mov eax, dword [ecx*4 + 0x658310]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x30], edx
sub edx, eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], esi
lea edx, [eax - 1]
lea esi, [esp + 0x20]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
mov byte [esp + 0x20], 1
call fcn.004e88c0
mov eax, dword [esp + 0xcc]
cmp eax, ebx
jle 0x4e86c1
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xc8]
sub edx, ebp
mov ecx, ebp
sub esi, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
jmp 0x4e85d0
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, edi
cmp dword [esp + 0xc0], ebx
jne 0x4e85dd
xor edi, edi
jmp 0x4e85e0
mov edi, dword [edx + ecx]
cmp dword [esp + 0xb8], ebx
mov ebp, dword [ecx]
jne 0x4e85ef
xor esi, esi
jmp 0x4e85f2
mov esi, dword [esi + ecx]
lea eax, [esp + 0x20]
call fcn.004e8720
push esi
push ebp
push edi
lea eax, [esp + 0x2c]
call fcn.004e87c0
mov eax, dword [esp + 0x70]
add esp, 0xc
cmp eax, ebx
jg 0x4e861b
cmp byte [esp + 0xd0], bl
je 0x4e8648
mov ecx, dword [esp + 0x60]
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x5c]
add eax, ecx
mov ecx, dword [esp + 0x58]
add edi, eax
sub esi, eax
add edx, eax
inc ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
cmp dword [esp + 0x28], 1
jne 0x4e8672
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, 4
dec eax
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x4e85c2
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
mov edi, dword [edx*4 + 0x658310]
xor eax, eax
cmp ecx, ebx
jle 0x4e870d
mov eax, dword [edi + 0x14]
cmp eax, 1
jle 0x4e8706
movzx esi, byte [eax + 0x6583cf]
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x14], eax
push esi
lea ecx, [esp + 0x18]
lea eax, [esp + 0x40]
call fcn.004cdc30
add esp, 4
mov dword [esp + 0xac], esi
mov eax, dword [edi + 0xc]
add eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x501da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x74]
jmp 0x501db0
mov ecx, dword [0x851c30]
mov edx, dword [ecx + 0x34]
mov eax, edi
and eax, 0xffff
lea eax, [eax + eax*2]
mov ebp, dword [edx + eax*4 + 8]
cmp edi, dword [esp + 0x88]
je 0x501ff1
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x501ff1
test eax, 0x1000000
jne 0x501ff1
test byte [ebp + 0x106], 4
je 0x501e01
cmp word [ebp + 0xb4], 0
je 0x501ff1
fld dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
fadd dword [ebp + 0xac]
fld dword [ebp + 0xa0]
fsub dword [esi]
fld dword [ebp + 0xa4]
fsub dword [esi + 4]
fld dword [ebp + 0xa8]
fsub dword [esi + 8]
fld st(2)
fmul st(3)
fld st(1)
fmul st(2)
faddp st(1)
fld st(2)
fmul st(3)
faddp st(1)
fld st(4)
fmul st(5)
fcompp
fstp st(0)
fstp st(0)
fnstsw ax
fstp st(0)
test ah, 1
fstp st(0)
jne 0x501ff1
movsx eax, word [ebp + 0xb4]
mov edx, dword [esp + 0x70]
lea ecx, [eax + 8]
mov ebx, 1
shl ebx, cl
test edx, ebx
je case.0x501e7f.2
cmp eax, 8
ja case.0x501e7f.2
movzx ecx, byte [eax + 0x502014]
jmp dword [ecx*4 + 0x502008]
test edx, 0x200000
je 0x501e9b
test byte [ebp + 0x4cc], 0x10
jne case.0x501e7f.2
mov ecx, dword [ebp + 0x11c]
mov eax, 0xffffffff
cmp ecx, eax
je 0x501eb7
cmp word [ebp + 0x2f0], ax
jne case.0x501e7f.2
lea edx, [esp + 0x74]
push edx
lea ebx, [esp + 0x14]
lea eax, [esp + 0x18]
mov ecx, edi
call fcn.00555cc0
fld dword [esp + 0x20]
fadd dword [esp + 0x78]
mov ecx, dword [esp + 0x90]
add esp, 4
push 0xff
fstp dword [esp + 0x20]
push 0
fld dword [esp + 0x18]
push 0xffffffffffffffff
fadd dword [esp + 0x90]
push edi
sub esp, 8
or edi, 0xffffffff
fstp dword [esp + 4]
lea esi, [esp + 0x2c]
fld dword [esp + 0x8c]
fadd dword [esp + 0x98]
fstp dword [esp]
call fcn.004fef40
mov esi, dword [esp + 0x90]
jmp 0x501fa9
mov ebx, 1
mov ecx, eax
shl ebx, cl
test bl, 2
je 0x501f71
test edx, 0x400000
je 0x501f71
mov ebx, edi
lea eax, [esp + 0x30]
call fcn.00503090
test al, al
je case.0x501e7f.2
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push eax
push ecx
push edx
lea ebx, [esp + 0x3c]
call fcn.00503370
add esp, 0xc
jmp case.0x501e7f.2
lea ecx, [esp + 0x20]
call fcn.005009f0
test al, al
je case.0x501e7f.2
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x80]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00500de0
add esp, 0x18
mov eax, dword [ebp + 0x118]
cmp eax, 0xffffffff
je 0x501ff1
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push ecx
push edx
push esi
push eax
mov eax, dword [esp + 0x8c]
push eax
call fcn.00501da0
add esp, 0x20
mov edi, dword [ebp + 0x114]
cmp edi, 0xffffffff
jne 0x501db0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x5031f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
lea ebp, [edi + 8]
lea edx, [esp + 0x20]
mov esi, eax
mov ecx, ebp
mov byte [esp + 0xf], 0
mov dword [ebx], 0x7f7fffff
call fcn.004ca2c0
mov edx, dword [esp + 0x40]
push ebp
lea eax, [esp + 0x18]
call fcn.004ca350
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 0x74]
add esp, 4
xor esi, esi
test eax, eax
jle 0x503361
xor eax, eax
jmp 0x503240
mov edi, dword [ecx + 0x78]
shl eax, 7
mov ecx, dword [eax + edi + 0x68]
add eax, edi
push ecx
add eax, 0x38
push eax
lea ecx, [esp + 0x34]
lea edi, [esp + 0x18]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x28]
call fcn.004cc6e0
add esp, 8
test al, al
je 0x5032d5
fld dword [ebx]
fcomp dword [esp + 0x10]
fnstsw ax
test ah, 0x41
jne 0x5032d5
fld dword [esp + 0x14]
mov edx, dword [esp + 0x10]
fmul dword [esp + 0x10]
mov dword [ebx], edx
mov edx, dword [esp + 0x2c]
lea eax, [ebx + 4]
fadd dword [esp + 0x20]
mov ecx, eax
fld dword [esp + 0x18]
mov dword [ecx], edx
fmul dword [esp + 0x10]
mov edx, dword [esp + 0x30]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x34]
fadd dword [esp + 0x24]
mov dword [ecx + 8], edx
fld dword [esp + 0x1c]
mov byte [esp + 0xf], 1
fmul dword [esp + 0x10]
fadd dword [esp + 0x28]
fmul dword [eax + 8]
fxch st(1)
fmul dword [eax + 4]
faddp st(1)
fxch st(1)
fmul dword [eax]
faddp st(1)
fstp dword [eax + 0xc]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x74]
inc esi
movsx eax, si
cmp eax, edx
jl 0x503240
mov al, byte [esp + 0xf]
test al, al
je 0x503365
fld dword [ebx + 4]
pop edi
fld dword [ebx + 8]
pop esi
fld dword [ebx + 0xc]
fld st(0)
fmul dword [ebp + 0x1c]
fld st(2)
fmul dword [ebp + 0x10]
faddp st(1)
fld st(3)
fmul dword [ebp + 4]
faddp st(1)
fstp dword [ebx + 4]
fld st(0)
fmul dword [ebp + 0x20]
fld st(2)
fmul dword [ebp + 0x14]
faddp st(1)
fld st(3)
fmul dword [ebp + 8]
faddp st(1)
fstp dword [ebx + 8]
fmul dword [ebp + 0x24]
fxch st(1)
fmul dword [ebp + 0x18]
faddp st(1)
fxch st(1)
fmul dword [ebp + 0xc]
faddp st(1)
fst dword [ebx + 0xc]
fmul dword [ebp + 0x30]
fld dword [ebp + 0x2c]
fmul dword [ebx + 8]
faddp st(1)
fld dword [ebx + 0x10]
fmul dword [ebp]
faddp st(1)
fld dword [ebp + 0x28]
pop ebp
fmul dword [ebx + 4]
faddp st(1)
fstp dword [ebx + 0x10]
add esp, 0x2c
ret
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
Function at 0x5106b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
push ebx
mov ebx, eax
mov al, byte [0x68332a]
test al, al
push esi
push edi
mov edi, ecx
je 0x5108a8
cmp word [0x7b2aa0], 1
jne 0x5108a8
mov al, byte [0x6d1ec8]
inc word [0x695f44]
mov ecx, dword [0x6d1ed4]
neg al
sbb eax, eax
and eax, ecx
mov dword [esp + 0x1c], eax
je 0x5108a8
mov eax, dword [ebp + 0x10]
cmp word [eax], 0
je 0x5108a8
push eax
call fcn.0062121a
mov edx, dword [0x7b49c0]
mov si, word [0x7b49c2]
add esp, 4
test edi, edi
jne 0x51076e
mov ecx, dword [0x7b49c8]
mov eax, dword [0x7b49cc]
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x14]
shr edi, 0x10
mov cx, si
neg cx
add di, cx
mov dword [esp + 0x18], eax
mov word [esp + 0x16], di
mov edi, dword [esp + 0x18]
mov eax, edx
shr edi, 0x10
neg eax
add word [esp + 0x14], ax
add di, cx
add word [esp + 0x18], ax
mov word [esp + 0x1a], di
jmp 0x51077b
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
test ebx, ebx
jne 0x5107ba
mov ecx, dword [0x7b49c4]
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0xc]
neg si
mov edi, ecx
shr ebx, 0x10
shr edi, 0x10
neg edx
add word [esp + 0xc], dx
add bx, si
add di, si
mov dword [esp + 0x10], ecx
add word [esp + 0x10], dx
mov word [esp + 0xe], bx
mov word [esp + 0x12], di
jmp 0x510811
mov ax, word [ebx + 4]
cmp ax, 0x1e0
movsx esi, ax
jl 0x5107cc
mov esi, 0x1e0
mov ax, word [ebx + 6]
cmp ax, 0x280
movsx edx, ax
jl 0x5107de
mov edx, 0x280
mov ax, word [ebx]
test ax, ax
jge 0x5107ea
xor ecx, ecx
jmp 0x5107ed
movsx ecx, ax
mov ax, word [ebx + 2]
test ax, ax
jge 0x5107fa
xor eax, eax
jmp 0x5107fd
movsx eax, ax
mov word [esp + 0xe], ax
mov word [esp + 0xc], cx
mov word [esp + 0x12], dx
mov word [esp + 0x10], si
xor eax, eax
mov ecx, 0x23
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
movsx edx, word [eax + 4]
mov dword [esp + 0x1c], edx
movsx ecx, word [eax + 6]
fild dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
fdivr dword [0x66c410]
lea edi, [esp + 0x20]
mov dword [esp + 0x4c], 0x3f800000
mov dword [esp + 0x48], 0x3f800000
mov dword [esp + 0x20], ecx
mov byte [esp + 0xaa], cl
mov word [esp + 0xa8], cx
mov dword [esp + 0x2c], eax
fstp dword [esp + 0x60]
fild dword [esp + 0x1c]
fdivr dword [0x66c410]
fstp dword [esp + 0x64]
call fcn.0052d410
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x24]
push eax
push 0x5108e0
call fcn.00552160
add esp, 0x18
call fcn.0052d720
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret