joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512d00
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [0x686ac0]
push esi
push edi
mov edi, dword [esp + 0x20]
test ecx, ecx
je 0x512d4d
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x512d4d
push edi
lea eax, [esp + 0x10]
push str._ENTER__PzExtSocket::_SendMess_length_d_
push eax
mov dword [esp + 0x18], str..._xsocket.cpp
mov dword [esp + 0x1c], 0xae
mov dword [esp + 0x20], 0x14
call fcn.0050c8a0
add esp, 0xc
push edi
call sub.WSOCK32.dll_htonl
add edi, 4
xor esi, esi
mov dword [ebx + 8], eax
test edi, edi
jle 0x512da5
nop
mov eax, dword [ebx]
push 0
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [ebx + esi + 8]
push edx
push eax
call sub.WSOCK32.dll_send
test eax, eax
jle 0x512d80
add esi, eax
cmp esi, edi
jl 0x512d60
jmp 0x512da5
jge 0x512d8e
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x686ad4], eax
jmp 0x512d98
mov dword [0x686ad4], 0
mov dword [0x686ad0], 8
or esi, 0xffffffff
add ebx, 4
push ebx
call dword [sym.imp.MSVCR90.dll__time32]
mov ecx, dword [0x686ac0]
add esp, 4
test ecx, ecx
je 0x512df3
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x28
jl 0x512df3
push esi
lea ecx, [esp + 0x10]
push str._EXIT__PzExtSocket::_SendMess__:_d
push ecx
mov dword [esp + 0x18], str..._xsocket.cpp
mov dword [esp + 0x1c], 0xc3
mov dword [esp + 0x20], 0x28
call fcn.0050c8a0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x5134a0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov ecx, dword [0x686ac0]
sub esp, 0x14
push ebp
push esi
mov esi, eax
mov ebp, str..._xsocket.cpp
test ecx, ecx
je 0x513508
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x513508
test ebx, ebx
je 0x5134d0
mov eax, dword [ebx]
push eax
call sub.WSOCK32.dll_inet_ntoa
jmp 0x5134d5
mov eax, str._NULL_
mov ecx, esi
test esi, esi
jne 0x5134e0
mov ecx, str._null_
push eax
push ecx
lea ecx, [esp + 0x14]
push str._ENTERING__GetHostEntry_name_s__inaddr_s_
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x1dc
mov dword [esp + 0x24], 0x14
call fcn.0050c8a0
add esp, 0x10
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x513581
push esi
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x513539
test ebx, ebx
je 0x5135fc
mov edx, dword [esi + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebx], ecx
jmp 0x5135fc
mov dword [0x686ad0], 1
call fcn.00512ac0
mov ecx, dword [0x686ac0]
mov dword [0x686ad4], eax
test ecx, ecx
je 0x513660
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x5135fc
mov ecx, dword [0x686ad4]
push ecx
mov dword [esp + 0x14], 0x1ee
push str.FAILED:_gethostbyname:__d
jmp 0x5135e3
push 2
push 4
lea eax, [esp + 0x10]
push eax
call sub.WSOCK32.dll_gethostbyaddr
mov esi, eax
test esi, esi
je 0x5135a1
test ebx, ebx
je 0x5135fc
mov ecx, dword [esp + 8]
mov dword [ebx], ecx
jmp 0x5135fc
mov dword [0x686ad0], 2
call fcn.00512ac0
mov ecx, dword [0x686ac0]
mov dword [0x686ad4], eax
test ecx, ecx
je 0x513660
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x5135fc
mov ecx, dword [0x686ad4]
push ecx
mov dword [esp + 0x14], 0x1fb
push str.FAILED:_gethostbyaddr:__d
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], 0xa
call fcn.0050c8a0
add esp, 0xc
mov ecx, dword [0x686ac0]
test ecx, ecx
je 0x513660
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x513660
push edi
test esi, esi
je 0x51361f
mov eax, dword [esi]
mov edi, eax
test eax, eax
jne 0x513624
mov edi, str._NULL_
test ebx, ebx
je 0x513632
mov eax, dword [ebx]
push eax
call sub.WSOCK32.dll_inet_ntoa
jmp 0x513637
mov eax, str._NULL_
push edi
push eax
lea ecx, [esp + 0x18]
push str._EXITING__GetHostEntry_inaddr_s_:__s
push ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], 0x1ff
mov dword [esp + 0x28], 0x28
call fcn.0050c8a0
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x513bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x621b23
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x34]
push 0
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.PzExtAuthClient.0
call fcn.005029e0
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 0
push 0
lea ecx, [esi + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esi], vtable.PzExtAuthClient_ww.0
call fcn.00502660
mov ecx, dword [0x686ac0]
mov byte [esp + 0x28], 1
test ecx, ecx
je 0x513c72
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x14
jl 0x513c72
mov ecx, dword [esp + 0x38]
test ecx, ecx
jne 0x513c3b
mov ecx, 0x633c9c
mov eax, edi
test edi, edi
jne 0x513c46
mov eax, 0x633c9c
push ecx
push eax
lea ecx, [esp + 0x18]
push str._ENTER__PzExtAuthClient_ww::PzExtAuthClient_ww__hostname_s__package_s_
push ecx
mov dword [esp + 0x20], str..._xauthc.cpp
mov dword [esp + 0x24], 0xaf
mov dword [esp + 0x28], 0x14
call fcn.0050c8a0
add esp, 0x10
call fcn.00517520
mov ecx, eax
mov dword [esi + 0x28], eax
call fcn.00516960
push str.OZ_AUTH_TYPE
call fcn.00506030
mov edi, eax
add esp, 4
test edi, edi
je 0x513ca2
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x513c97
sub eax, edx
jne 0x513ca7
mov edi, str.NTLM
mov ecx, dword [0x686ac0]
test ecx, ecx
je 0x513cf3
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x32
jl 0x513cf3
mov eax, edi
test edi, edi
jne 0x513cc8
mov eax, str._null_
push eax
lea ecx, [esp + 0x14]
push str.__auth_type:__s
push ecx
mov dword [esp + 0x1c], str..._xauthc.cpp
mov dword [esp + 0x20], 0xbd
mov dword [esp + 0x24], 0x32
call fcn.0050c8a0
add esp, 0xc
mov edx, dword [esi + 0x28]
mov eax, dword [edx]
mov edx, dword [eax + 0x44]
lea ecx, [esi + 0x24]
push ecx
push edi
call edx
mov ecx, dword [0x686ac0]
test ecx, ecx
je 0x513d42
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x513d42
lea eax, [esp + 0x10]
push str._EXIT__PzExtAuthClient_ww::PzExtAuthClient_ww
push eax
mov dword [esp + 0x18], str..._xauthc.cpp
mov dword [esp + 0x1c], 0xc1
mov dword [esp + 0x20], 0x28
call fcn.0050c8a0
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x519c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x621f8b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x4c]
sub edx, dword [esp + 0x44]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fild dword [esp + 0x54]
mov dword [esp + 0x54], edx
fst qword [esp + 0x28]
fild dword [esp + 0x54]
fsub st(2)
fdivrp st(1)
fldz
fcom st(1)
fnstsw ax
fld qword [0x634650]
test ah, 0x41
jp 0x519c9f
fadd st(2), st(0)
jmp 0x519ca1
fsub st(2), st(0)
fxch st(2)
call fcn.005fbb60
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
fld qword [0x6447a0]
fmul st(1)
fxch st(1)
fmul st(3)
fild dword [esp + 0x44]
fsub st(1)
fcom st(3)
fnstsw ax
test ah, 1
jne 0x519ccf
fadd st(4)
jmp 0x519cd1
fsub st(4)
call fcn.005fbb60
fild dword [esp + 0x48]
mov esi, eax
mov dword [esp + 0x10], esi
fsub st(2)
fcom st(3)
fnstsw ax
test ah, 1
jne 0x519cef
fadd st(4)
jmp 0x519cf1
fsub st(4)
call fcn.005fbb60
fiadd dword [esp + 0x4c]
mov dword [esp + 0x14], eax
fsubrp st(4)
fxch st(3)
fcom st(1)
fnstsw ax
test ah, 1
jne 0x519d0f
fadd st(2)
jmp 0x519d11
fsub st(2)
call fcn.005fbb60
fild dword [esp + 0x50]
mov edi, eax
mov dword [esp + 0x20], edi
fsub st(3)
fcom st(1)
fnstsw ax
test ah, 1
jne 0x519d2f
fadd st(2)
jmp 0x519d31
fsub st(2)
call fcn.005fbb60
mov dword [esp + 0x24], eax
mov eax, edi
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
xor esi, esi
cmp eax, esi
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
jl 0x519d57
fadd st(2)
jmp 0x519d59
fsub st(2)
call fcn.005fbb60
fld st(3)
fmul st(2)
mov dword [esp + 0x18], eax
fmul qword [esp + 0x28]
fild dword [esp + 0x14]
faddp st(5)
faddp st(4)
fxch st(3)
faddp st(2)
fxch st(2)
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x519d85
faddp st(1)
jmp 0x519d87
fsubrp st(1)
call fcn.005fbb60
push 0x10
mov dword [esp + 0x20], eax
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x54], eax
mov dword [esp + 0x38], esi
cmp eax, esi
je 0x519daf
mov ecx, eax
call fcn.0052ac40
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0xffffffff
call fcn.005281a0
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.005281a0
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.005281a0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.005281a0
push esi
mov ecx, ebx
call fcn.00519a10
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
push edx
call fcn.005f3cc0
mov dword [eax], esi
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x18
Function at 0x51abf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6220e1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x685e38]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
mov edi, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
call fcn.00528470
lea eax, [esp + 0x14]
push eax
mov ecx, edi
mov dword [esp + 0x34], 1
call fcn.00519020
test eax, eax
jne 0x51ac6c
mov ecx, edi
call fcn.004a5b20
push eax
mov ecx, edi
call fcn.004a5b20
push eax
mov ecx, esi
call fcn.0051b7b0
jmp 0x51ac76
push esi
lea ecx, [esp + 0x18]
call fcn.00528030
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
mov byte [esp + 0x30], 0
call fcn.00528dc0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005fb9ce
add esp, 0x28
ret 4
Function at 0x51bb80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x6221a8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
call fcn.005242e0
lea ecx, [esi + 0x14]
mov dword [esp + 0x80], 0
mov dword [esi], vtable.ZgeoArc.0
call fcn.005f4550
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ebx, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
mov dword [esi + 8], ecx
mov edx, dword [ebx]
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 4]
push ecx
push edi
mov dword [esi + 0x10], eax
call fcn.005251f0
fst qword [esp + 0x30]
add esp, 4
fstp qword [esp]
call fcn.00524cc0
add esp, 8
test eax, eax
je 0x51bcb0
mov eax, dword [edi]
cmp dword [ebx], eax
jne 0x51bc70
mov edx, dword [edi + 4]
cmp dword [ebx + 4], edx
jne 0x51bc70
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
cmp ecx, eax
jne 0x51bc2d
cmp dword [ebx + 4], edx
je 0x51bc70
mov eax, dword [ebx + 4]
sub ecx, dword [edi]
sub eax, edx
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.00522940
push eax
lea ecx, [esi + 0x14]
call fcn.00522bf0
push ebx
mov ecx, edi
call fcn.005f0500
fld qword [0x634650]
fmul st(1), st(0)
faddp st(1)
call fcn.005fbb60
mov edx, 2
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], dx
jmp 0x51bd6b
fldz
sub esp, 0x10
fst qword [esp + 8]
lea ecx, [esp + 0x4c]
fstp qword [esp]
mov dword [esi + 0x1c], 0
call fcn.00522a00
push eax
lea ecx, [esi + 0x14]
call fcn.00522bf0
push 0x305
call fcn.005f4440
mov eax, 1
add esp, 4
mov word [esi + 0x20], ax
jmp 0x51bd6b
fldz
fcomp qword [esp + 0x24]
fnstsw ax
test ah, 5
jp 0x51bcc5
xor ecx, ecx
mov word [esi + 0x20], cx
jmp 0x51bcce
mov edx, 1
mov word [esi + 0x20], dx
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push edx
push edi
call fcn.0052b210
fild dword [esi + 4]
add esp, 4
fsubr qword [esp + 0x3c]
fst qword [esp + 0x34]
fild dword [esi + 8]
fsubr qword [esp + 0x44]
fst qword [esp + 0x4c]
fstp qword [esp + 8]
fstp qword [esp]
call fcn.0052afe0
fld qword [0x634650]
add esp, 0x10
fadd st(1), st(0)
fxch st(1)
call fcn.005fbb60
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
mov dword [esi + 0x1c], eax
fdivr qword [0x6448b0]
fld qword [esp + 0x24]
fmul st(1)
fxch st(1)
fmul qword [esp + 0x3c]
fldz
fcom st(2)
fnstsw ax
fxch st(2)
test ah, 0x41
jp 0x51bd48
fadd st(3)
jmp 0x51bd4a
fsub st(3)
call fcn.005fbb60
fcom st(1)
mov dword [esi + 0x14], eax
fnstsw ax
fstp st(1)
test ah, 1
jne 0x51bd61
faddp st(1)
jmp 0x51bd63
fsubrp st(1)
call fcn.005fbb60
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51c310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6227d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.005242e0
lea edi, [esi + 0x14]
mov ecx, edi
mov dword [esp + 0x18], 0
mov dword [esi], vtable.ZgeoArc.0
call fcn.005f4550
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x1c], edx
mov word [esi + 0x20], cx
mov edx, dword [esi + 0xc]
cmp edx, dword [esi + 4]
jne 0x51c39a
mov edx, dword [esi + 0x10]
cmp edx, dword [esi + 8]
jne 0x51c39a
or ecx, 2
mov word [esi + 0x20], cx
mov ecx, dword [esp + 0x24]
fild dword [esp + 0x2c]
mov edx, dword [ecx]
sub edx, dword [eax]
fdivr qword [0x6448b0]
mov ecx, dword [ecx + 4]
sub ecx, dword [eax + 4]
mov dword [esp + 0x2c], edx
fild dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
fmul st(1)
fild dword [esp + 0x2c]
fmulp st(2)
fldz
fcom st(1)
fnstsw ax
fld qword [0x634650]
test ah, 0x41
jp 0x51c3db
fadd st(2), st(0)
jmp 0x51c3dd
fsub st(2), st(0)
fxch st(2)
call fcn.005fbb60
fcomp st(2)
mov dword [edi], eax
fnstsw ax
test ah, 0x41
jp 0x51c3f3
faddp st(1)
jmp 0x51c3f5
fsubp st(1)
call fcn.005fbb60
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x51f8b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x622338
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00524ff0
add esp, 0xc
mov edi, eax
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [edi + 0x10]
lea ecx, [edi + 0x14]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 0x1c]
push ecx
lea ecx, [esi + 0x14]
mov dword [esp + 0x3c], 0
mov dword [esi + 0x1c], eax
call fcn.00522bf0
mov dx, word [edi + 0x20]
lea ecx, [esp + 0xc]
mov word [esi + 0x20], dx
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0xc], vtable.ZgeoArc.0
call fcn.005242f0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x5214c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x62af70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
call fcn.005242e0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x10]
mov edi, vtable.ZgeoLine.0
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.005242e0
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x44]
cdq
sub eax, edx
mov esi, eax
push 0
sar esi, 1
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 1
call fcn.00521090
push 1
push esi
lea ecx, [esp + 0x14]
call fcn.00521090
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 0x1c], ecx
lea ecx, [esp + 0xc]
mov dword [eax + 0x18], edx
mov byte [esp + 0x3c], 0
mov dword [esp + 0xc], edi
call fcn.005242f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x20], edi
call fcn.005242f0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 8
Function at 0x524ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x622591
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x685e38]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x14], 0
cmp dword [esi], 1
mov dword [esp + 0x20], ebx
jne 0x525093
cmp dword [esi + 4], 0
jne 0x525093
cmp dword [esi + 8], 1
jne 0x525093
cmp dword [esi + 0xc], 0
jne 0x525093
fldz
sub esp, 8
mov eax, esp
fstp qword [eax]
lea ecx, [esi + 0x10]
mov dword [esp + 0x20], esp
call fcn.005f1260
test eax, eax
je 0x525093
push 1
lea ecx, [esp + 0x1c]
call fcn.00532690
mov ecx, dword [eax + 4]
mov edx, dword [esi + 0x1c]
imul ecx, dword [esi + 0x18]
imul edx, dword [eax]
cmp ecx, edx
jne 0x525093
push edi
mov ecx, ebx
call fcn.0051ec30
jmp 0x52517c
mov eax, dword [esi + 8]
imul eax, dword [esi]
test eax, eax
movzx eax, word [edi + 0x20]
jge 0x5250ae
mov ecx, eax
xor ecx, 1
and ecx, 0xfffffff9
movzx ebp, cx
jmp 0x5250b6
mov edx, eax
and edx, 0xfffffff9
movzx ebp, dx
test al, 2
je 0x5250c1
mov eax, 2
jmp 0x5250c5
cwde
and eax, 0xfffffffb
test al, 2
je 0x5250cc
or ebp, 2
lea eax, [edi + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00525510
mov edx, dword [edi]
mov edx, dword [edx + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call edx
push eax
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.00525510
push eax
lea ecx, [edi + 4]
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.00525510
push eax
push ebp
lea ecx, [esp + 0x4c]
call fcn.0051e770
movzx eax, word [edi + 0x20]
mov esi, 1
mov dword [esp + 0x6c], esi
test al, 2
jne 0x52515e
cwde
and eax, 0xfffffffb
cmp ax, 2
je 0x52515e
test byte [esp + 0x5c], 2
jne 0x525144
movsx eax, word [esp + 0x5c]
and eax, 0xfffffffb
cmp ax, 2
jne 0x52515e
mov ecx, edi
call fcn.0051f0a0
fcomp qword [0x6345e0]
fnstsw ax
test ah, 5
jp 0x52515e
and word [esp + 0x5c], 0xfffd
lea eax, [esp + 0x3c]
push eax
mov ecx, ebx
call fcn.0051ec30
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], esi
mov byte [esp + 0x6c], 0
call fcn.0051c420
mov eax, ebx
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005fb9ce
add esp, 0x5c
ret
Function at 0x527640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x622748
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
fld qword [0x6448d8]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
fstp qword [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
jle 0x5276d2
mov esi, dword [ebp + 8]
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
push esi
call fcn.005f0500
fild dword [edi + 0x10]
fcom st(1)
fnstsw ax
test ah, 0x41
jnp 0x527707
fsubrp st(1)
fcom qword [esp + 0x1c]
fnstsw ax
test ah, 5
jp 0x5276c7
mov ecx, dword [esi]
fstp qword [esp + 0x1c]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x5276c9
fstp st(0)
inc ebx
add esi, 8
cmp ebx, dword [ebp + 0xc]
jl 0x527691
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov edx, dword [edi]
mov edx, dword [edx + 0x50]
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0xc]
fstp st(1)
mov ecx, dword [esp + 0x10]
fstp st(0)
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.0051aeb0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], 0
call fcn.00526ab0
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.0051afa0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc