joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fb0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5e40a1
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x14], 0
cmp dword [esi], 1
mov dword [esp + 0x20], ebx
jne 0x4fb143
cmp dword [esi + 4], 0
jne 0x4fb143
cmp dword [esi + 8], 1
jne 0x4fb143
cmp dword [esi + 0xc], 0
jne 0x4fb143
fldz
sub esp, 8
mov eax, esp
fstp qword [eax]
lea ecx, [esi + 0x10]
mov dword [esp + 0x20], esp
call fcn.005bee60
test eax, eax
je 0x4fb143
push 1
lea ecx, [esp + 0x1c]
call fcn.005085f0
mov ecx, dword [eax + 4]
mov edx, dword [esi + 0x1c]
imul ecx, dword [esi + 0x18]
imul edx, dword [eax]
cmp ecx, edx
jne 0x4fb143
push edi
mov ecx, ebx
call fcn.004f3d50
jmp 0x4fb22c
mov eax, dword [esi + 8]
imul eax, dword [esi]
test eax, eax
movzx eax, word [edi + 0x20]
jge 0x4fb15e
mov ecx, eax
xor ecx, 1
and ecx, 0xfffffff9
movzx ebp, cx
jmp 0x4fb166
mov edx, eax
and edx, 0xfffffff9
movzx ebp, dx
test al, 2
je 0x4fb171
mov eax, 2
jmp 0x4fb175
cwde
and eax, 0xfffffffb
test al, 2
je 0x4fb17c
or ebp, 2
lea eax, [edi + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.004fad10
mov edx, dword [edi]
mov edx, dword [edx + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call edx
push eax
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.004fad10
push eax
lea ecx, [edi + 4]
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.004fad10
push eax
push ebp
lea ecx, [esp + 0x4c]
call fcn.004f3890
movzx eax, word [edi + 0x20]
mov esi, 1
mov dword [esp + 0x6c], esi
test al, 2
jne 0x4fb20e
cwde
and eax, 0xfffffffb
cmp ax, 2
je 0x4fb20e
test byte [esp + 0x5c], 2
jne 0x4fb1f4
movsx eax, word [esp + 0x5c]
and eax, 0xfffffffb
cmp ax, 2
jne 0x4fb20e
mov ecx, edi
call fcn.004f41c0
fcomp qword [0x5f3dd0]
fnstsw ax
test ah, 5
jp 0x4fb20e
and word [esp + 0x5c], 0xfffd
lea eax, [esp + 0x3c]
push eax
mov ecx, ebx
call fcn.004f3d50
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], esi
mov byte [esp + 0x6c], 0
call fcn.004f1b60
mov eax, ebx
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x5c
ret
Function at 0x4fd300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e41bb
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x4c]
sub edx, dword [esp + 0x44]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fild dword [esp + 0x54]
mov dword [esp + 0x54], edx
fst qword [esp + 0x28]
fild dword [esp + 0x54]
fsub st(2)
fdivrp st(1)
fldz
fcom st(1)
fnstsw ax
fld qword [0x5f3df0]
test ah, 0x41
jp 0x4fd36f
fadd st(2), st(0)
jmp 0x4fd371
fsub st(2), st(0)
fxch st(2)
call fcn.005c3ce0
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
fld qword [0x602340]
fmul st(1)
fxch st(1)
fmul st(3)
fild dword [esp + 0x44]
fsub st(1)
fcom st(3)
fnstsw ax
test ah, 1
jne 0x4fd39f
fadd st(4)
jmp 0x4fd3a1
fsub st(4)
call fcn.005c3ce0
fild dword [esp + 0x48]
mov esi, eax
mov dword [esp + 0x10], esi
fsub st(2)
fcom st(3)
fnstsw ax
test ah, 1
jne 0x4fd3bf
fadd st(4)
jmp 0x4fd3c1
fsub st(4)
call fcn.005c3ce0
fiadd dword [esp + 0x4c]
mov dword [esp + 0x14], eax
fsubrp st(4)
fxch st(3)
fcom st(1)
fnstsw ax
test ah, 1
jne 0x4fd3df
fadd st(2)
jmp 0x4fd3e1
fsub st(2)
call fcn.005c3ce0
fild dword [esp + 0x50]
mov edi, eax
mov dword [esp + 0x20], edi
fsub st(3)
fcom st(1)
fnstsw ax
test ah, 1
jne 0x4fd3ff
fadd st(2)
jmp 0x4fd401
fsub st(2)
call fcn.005c3ce0
mov dword [esp + 0x24], eax
mov eax, edi
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
xor esi, esi
cmp eax, esi
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
jl 0x4fd427
fadd st(2)
jmp 0x4fd429
fsub st(2)
call fcn.005c3ce0
fld st(3)
fmul st(2)
mov dword [esp + 0x18], eax
fmul qword [esp + 0x28]
fild dword [esp + 0x14]
faddp st(5)
faddp st(4)
fxch st(3)
faddp st(2)
fxch st(2)
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x4fd455
faddp st(1)
jmp 0x4fd457
fsubrp st(1)
call fcn.005c3ce0
push 0x10
mov dword [esp + 0x20], eax
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x54], eax
mov dword [esp + 0x38], esi
cmp eax, esi
je 0x4fd47f
mov ecx, eax
call fcn.0050a310
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0xffffffff
call fcn.004fffa0
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004fffa0
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.004fffa0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004fffa0
push esi
mov ecx, ebx
call fcn.004fd0e0
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
push edx
call fcn.005c2c20
mov dword [eax], esi
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x18
Function at 0x4fe2c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e4311
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
mov edi, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
call fcn.00500270
lea eax, [esp + 0x14]
push eax
mov ecx, edi
mov dword [esp + 0x34], 1
call fcn.004fc6a0
test eax, eax
jne 0x4fe33c
mov ecx, edi
call fcn.004feb00
push eax
mov ecx, edi
call fcn.004feb00
push eax
mov ecx, esi
call fcn.004f7280
jmp 0x4fe346
push esi
lea ecx, [esp + 0x18]
call fcn.004ffdc0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
mov byte [esp + 0x30], 0
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x28
ret 4

Function at 0x4ff700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e4438
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
fld qword [0x601fa8]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
fstp qword [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
jle 0x4ff792
mov esi, dword [ebp + 8]
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
push esi
call fcn.005befc0
fild dword [edi + 0x10]
fcom st(1)
fnstsw ax
test ah, 0x41
jnp 0x4ff7c7
fsubrp st(1)
fcom qword [esp + 0x1c]
fnstsw ax
test ah, 5
jp 0x4ff787
mov ecx, dword [esi]
fstp qword [esp + 0x1c]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x4ff789
fstp st(0)
inc ebx
add esi, 8
cmp ebx, dword [ebp + 0xc]
jl 0x4ff751
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov edx, dword [edi]
mov edx, dword [edx + 0x50]
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0xc]
fstp st(1)
mov ecx, dword [esp + 0x10]
fstp st(0)
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.004f73b0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], 0
call fcn.004fe590
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.004f74a0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ffa60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e4470
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebp
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ecx
inc esi
push eax
lea ecx, [esp + 0x30]
sar esi, 1
call fcn.004f8540
mov edi, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
push edi
push ecx
push edx
lea ecx, [esp + 0x34]
mov dword [esp + 0x64], 0
call fcn.00507f80
mov ebp, eax
sub ebp, esi
test ebp, ebp
jle 0x4ffb47
lea eax, [edi + 8]
push eax
push edi
lea ecx, [esp + 0x44]
call fcn.004f8540
neg esi
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x44]
mov byte [esp + 0x60], 1
call fcn.004f8dc0
mov edx, dword [eax]
mov dword [edi], edx
mov eax, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov dword [edi + 4], eax
mov byte [esp + 0x58], 0
call fcn.004f85b0
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], 0xffffffff
call fcn.004f85b0
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov eax, dword [edi + 8]
mov dword [edi], eax
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x28]
mov dword [edi + 4], eax
mov dword [esp + 0x58], 0xffffffff
call fcn.004f85b0
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x5058f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x50595e
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x50597d
push ecx
push esi
call fcn.005057d0
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret

Function at 0x505c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x505cae
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x505ccd
push edi
push ecx
call fcn.005058f0
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret

Function at 0x505d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x505d7e
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x505d9d
push esi
push ecx
call fcn.00504e40
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret
Function at 0x505de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x505e4e
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x505e6d
push esi
push ecx
call fcn.00504f60
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret

Function at 0x505ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x505f5e
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x505f7d
push esi
push ecx
call fcn.00504d20
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret

Function at 0x5063b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x50641e
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x50643d
push ecx
push esi
call fcn.00506110
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret
Function at 0x5064e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x50654e
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x50656d
push esi
push ecx
call fcn.00505580
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret

Function at 0x506590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x5065fe
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x50661d
push esi
push ecx
call fcn.005056b0
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret

Function at 0x506930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ef6b8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.004f9f70
mov ecx, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov dword [esp + 0x2c], 0
call fcn.004f8010
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.00506680
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.004fa010
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x506bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e46b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
lea eax, [esp + 8]
push eax
call fcn.004f64c0
push 4
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x30]
call fcn.005002b0
lea edx, [esp + 0x28]
push esi
push edx
mov dword [esp + 0x4c], 0
call fcn.005069b0
add esp, 8
lea ecx, [esp + 0x28]
mov esi, eax
mov dword [esp + 0x44], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x40
ret
Function at 0x508760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e4788
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.005bea00
xor edi, edi
lea ecx, [esi + 0x40]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.ZgeoVectorFontData.0
call fcn.005bd770
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5091c0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ecx, eax
and ecx, 0xffff
push edi
xor edi, edi
cmp ecx, 1
mov ecx, dword [esp + 0xc]
jne 0x509285
cmp ecx, 0x20
jl 0x50927e
cmp ecx, 0x7f
jg 0x50927e
test eax, 0x20000
je 0x509210
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call edx
pop edi
pop esi
ret 8
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + ecx*4]
mov eax, ecx
sar eax, 8
and ecx, 0xff
and eax, 0xffffff
cmp dword [esi + 0x10], 1
mov edi, ecx
jne 0x509253
mov ecx, dword [esi + 0x1c]
sub ecx, dword [esi + 0x24]
push edi
lea edx, [ecx + eax - 0xa0]
mov eax, dword [esp + 0x14]
push edx
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, edi
pop edi
sar eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.MSVCR90.dll_fseek]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x1c]
push edx
push edi
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x1c
mov eax, edi
pop edi
sar eax, 1
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8
push ecx
mov ecx, esi
call fcn.00508c00
cmp eax, 0xffffffff
jne 0x50929a
pop edi
or eax, 0xffffffff
pop esi
ret 8
mov edx, dword [esi + 0x20]
and edx, 0xffff
cmp edx, 2
jne 0x50931e
test eax, eax
jl 0x509292
mov edx, dword [esi + 0x24]
mov ecx, edx
sar ecx, 2
cmp eax, ecx
jg 0x509292
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx + eax*4]
mov eax, ecx
sar eax, 8
and ecx, 0xff
and eax, 0xffffff
cmp dword [esi + 0x10], 1
mov edi, ecx
jne 0x5092fa
mov ecx, dword [esi + 0x1c]
sub ecx, edx
lea edx, [ecx + eax - 0xa0]
mov eax, dword [esp + 0x10]
push edi
push edx
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
sar edi, 1
mov eax, edi
pop edi
pop esi
ret 8
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.MSVCR90.dll_fseek]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x1c]
push edx
push edi
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x1c
sar edi, 1
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x5097a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e4833
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.005bea00
xor edi, edi
lea ecx, [esi + 0x40]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.ZgeoVectorFontData.0
call fcn.005bd770
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x2c], ecx
push edx
mov ecx, esi
mov byte [esp + 0x1c], 1
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call fcn.00508e90
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc

Function at 0x50c6e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ecea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00500270
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004fc6a0
lea ecx, [esp + 0xc]
test eax, eax
jne 0x50c74e
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
xor eax, eax
jmp 0x50c77b
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x70]
call eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x3c]
push ecx
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00500bd0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x20
ret