joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5122f0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov ecx, dword [0x683998]
sub esp, 0x14
push ebp
push esi
mov esi, eax
mov ebp, str..._xsocket.cpp
test ecx, ecx
je 0x512358
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x512358
test ebx, ebx
je 0x512320
mov eax, dword [ebx]
push eax
call sub.WSOCK32.dll_inet_ntoa
jmp 0x512325
mov eax, str._NULL_
mov ecx, esi
test esi, esi
jne 0x512330
mov ecx, str._null_
push eax
push ecx
lea ecx, [esp + 0x14]
push str._ENTERING__GetHostEntry_name_s__inaddr_s_
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x1dc
mov dword [esp + 0x24], 0x14
call fcn.0050bb00
add esp, 0x10
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x5123d1
push esi
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x512389
test ebx, ebx
je 0x51244c
mov edx, dword [esi + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebx], ecx
jmp 0x51244c
mov dword [0x6839a8], 1
call fcn.00511910
mov ecx, dword [0x683998]
mov dword [0x6839ac], eax
test ecx, ecx
je 0x5124b0
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x51244c
mov ecx, dword [0x6839ac]
push ecx
mov dword [esp + 0x14], 0x1ee
push str.FAILED:_gethostbyname:__d
jmp 0x512433
push 2
push 4
lea eax, [esp + 0x10]
push eax
call sub.WSOCK32.dll_gethostbyaddr
mov esi, eax
test esi, esi
je 0x5123f1
test ebx, ebx
je 0x51244c
mov ecx, dword [esp + 8]
mov dword [ebx], ecx
jmp 0x51244c
mov dword [0x6839a8], 2
call fcn.00511910
mov ecx, dword [0x683998]
mov dword [0x6839ac], eax
test ecx, ecx
je 0x5124b0
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x51244c
mov ecx, dword [0x6839ac]
push ecx
mov dword [esp + 0x14], 0x1fb
push str.FAILED:_gethostbyaddr:__d
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], 0xa
call fcn.0050bb00
add esp, 0xc
mov ecx, dword [0x683998]
test ecx, ecx
je 0x5124b0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x5124b0
push edi
test esi, esi
je 0x51246f
mov eax, dword [esi]
mov edi, eax
test eax, eax
jne 0x512474
mov edi, str._NULL_
test ebx, ebx
je 0x512482
mov eax, dword [ebx]
push eax
call sub.WSOCK32.dll_inet_ntoa
jmp 0x512487
mov eax, str._NULL_
push edi
push eax
lea ecx, [esp + 0x18]
push str._EXITING__GetHostEntry_inaddr_s_:__s
push ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], 0x1ff
mov dword [esp + 0x28], 0x28
call fcn.0050bb00
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x512a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61fc13
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x34]
push 0
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.PzExtAuthClient.0
call fcn.00501c20
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 0
push 0
lea ecx, [esi + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esi], vtable.PzExtAuthClient_ww.0
call fcn.005018a0
mov ecx, dword [0x683998]
mov byte [esp + 0x28], 1
test ecx, ecx
je 0x512ac2
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x14
jl 0x512ac2
mov ecx, dword [esp + 0x38]
test ecx, ecx
jne 0x512a8b
mov ecx, 0x631c94
mov eax, edi
test edi, edi
jne 0x512a96
mov eax, 0x631c94
push ecx
push eax
lea ecx, [esp + 0x18]
push str._ENTER__PzExtAuthClient_ww::PzExtAuthClient_ww__hostname_s__package_s_
push ecx
mov dword [esp + 0x20], str..._xauthc.cpp
mov dword [esp + 0x24], 0xaf
mov dword [esp + 0x28], 0x14
call fcn.0050bb00
add esp, 0x10
call fcn.005163e0
mov ecx, eax
mov dword [esi + 0x28], eax
call fcn.00515820
push str.OZ_AUTH_TYPE
call fcn.005052d0
mov edi, eax
add esp, 4
test edi, edi
je 0x512af2
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x512ae7
sub eax, edx
jne 0x512af7
mov edi, str.NTLM
mov ecx, dword [0x683998]
test ecx, ecx
je 0x512b43
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x32
jl 0x512b43
mov eax, edi
test edi, edi
jne 0x512b18
mov eax, str._null_
push eax
lea ecx, [esp + 0x14]
push str.__auth_type:__s
push ecx
mov dword [esp + 0x1c], str..._xauthc.cpp
mov dword [esp + 0x20], 0xbd
mov dword [esp + 0x24], 0x32
call fcn.0050bb00
add esp, 0xc
mov edx, dword [esi + 0x28]
mov eax, dword [edx]
mov edx, dword [eax + 0x44]
lea ecx, [esi + 0x24]
push ecx
push edi
call edx
mov ecx, dword [0x683998]
test ecx, ecx
je 0x512b92
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x512b92
lea eax, [esp + 0x10]
push str._EXIT__PzExtAuthClient_ww::PzExtAuthClient_ww
push eax
mov dword [esp + 0x18], str..._xauthc.cpp
mov dword [esp + 0x1c], 0xc1
mov dword [esp + 0x20], 0x28
call fcn.0050bb00
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x518b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x62009b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x4c]
sub edx, dword [esp + 0x44]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fild dword [esp + 0x54]
mov dword [esp + 0x54], edx
fst qword [esp + 0x28]
fild dword [esp + 0x54]
fsub st(2)
fdivrp st(1)
fldz
fcom st(1)
fnstsw ax
fld qword [0x632648]
test ah, 0x41
jp 0x518b9f
fadd st(2), st(0)
jmp 0x518ba1
fsub st(2), st(0)
fxch st(2)
call fcn.005f9c80
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
fld qword [0x642398]
fmul st(1)
fxch st(1)
fmul st(3)
fild dword [esp + 0x44]
fsub st(1)
fcom st(3)
fnstsw ax
test ah, 1
jne 0x518bcf
fadd st(4)
jmp 0x518bd1
fsub st(4)
call fcn.005f9c80
fild dword [esp + 0x48]
mov esi, eax
mov dword [esp + 0x10], esi
fsub st(2)
fcom st(3)
fnstsw ax
test ah, 1
jne 0x518bef
fadd st(4)
jmp 0x518bf1
fsub st(4)
call fcn.005f9c80
fiadd dword [esp + 0x4c]
mov dword [esp + 0x14], eax
fsubrp st(4)
fxch st(3)
fcom st(1)
fnstsw ax
test ah, 1
jne 0x518c0f
fadd st(2)
jmp 0x518c11
fsub st(2)
call fcn.005f9c80
fild dword [esp + 0x50]
mov edi, eax
mov dword [esp + 0x20], edi
fsub st(3)
fcom st(1)
fnstsw ax
test ah, 1
jne 0x518c2f
fadd st(2)
jmp 0x518c31
fsub st(2)
call fcn.005f9c80
mov dword [esp + 0x24], eax
mov eax, edi
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
xor esi, esi
cmp eax, esi
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
jl 0x518c57
fadd st(2)
jmp 0x518c59
fsub st(2)
call fcn.005f9c80
fld st(3)
fmul st(2)
mov dword [esp + 0x18], eax
fmul qword [esp + 0x28]
fild dword [esp + 0x14]
faddp st(5)
faddp st(4)
fxch st(3)
faddp st(2)
fxch st(2)
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x518c85
faddp st(1)
jmp 0x518c87
fsubrp st(1)
call fcn.005f9c80
push 0x10
mov dword [esp + 0x20], eax
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x54], eax
mov dword [esp + 0x38], esi
cmp eax, esi
je 0x518caf
mov ecx, eax
call fcn.00529aa0
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0xffffffff
call fcn.00526ff0
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00526ff0
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00526ff0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00526ff0
push esi
mov ecx, ebx
call fcn.00518910
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
push edx
call fcn.005f1b40
mov dword [eax], esi
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x18
Function at 0x519af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6201f1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x682d00]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
mov edi, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
call fcn.005272c0
lea eax, [esp + 0x14]
push eax
mov ecx, edi
mov dword [esp + 0x34], 1
call fcn.00517f20
test eax, eax
jne 0x519b6c
mov ecx, edi
call fcn.00479880
push eax
mov ecx, edi
call fcn.00479880
push eax
mov ecx, esi
call fcn.0051a6e0
jmp 0x519b76
push esi
lea ecx, [esp + 0x18]
call fcn.00526e80
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
mov byte [esp + 0x30], 0
call fcn.00527c20
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005f9aee
add esp, 0x28
ret 4
Function at 0x51aab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x6202b8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
call fcn.00523100
lea ecx, [esi + 0x14]
mov dword [esp + 0x80], 0
mov dword [esi], vtable.ZgeoArc.0
call fcn.005f2930
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ebx, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
mov dword [esi + 8], ecx
mov edx, dword [ebx]
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 4]
push ecx
push edi
mov dword [esi + 0x10], eax
call fcn.00524000
fst qword [esp + 0x30]
add esp, 4
fstp qword [esp]
call fcn.00523ad0
add esp, 8
test eax, eax
je 0x51abe0
mov eax, dword [edi]
cmp dword [ebx], eax
jne 0x51aba0
mov edx, dword [edi + 4]
cmp dword [ebx + 4], edx
jne 0x51aba0
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
cmp ecx, eax
jne 0x51ab5d
cmp dword [ebx + 4], edx
je 0x51aba0
mov eax, dword [ebx + 4]
sub ecx, dword [edi]
sub eax, edx
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.00521820
push eax
lea ecx, [esi + 0x14]
call fcn.00521ad0
push ebx
mov ecx, edi
call fcn.005eea40
fld qword [0x632648]
fmul st(1), st(0)
faddp st(1)
call fcn.005f9c80
mov edx, 2
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], dx
jmp 0x51ac9b
fldz
sub esp, 0x10
fst qword [esp + 8]
lea ecx, [esp + 0x4c]
fstp qword [esp]
mov dword [esi + 0x1c], 0
call fcn.005218e0
push eax
lea ecx, [esi + 0x14]
call fcn.00521ad0
push 0x305
call fcn.005f2690
mov eax, 1
add esp, 4
mov word [esi + 0x20], ax
jmp 0x51ac9b
fldz
fcomp qword [esp + 0x24]
fnstsw ax
test ah, 5
jp 0x51abf5
xor ecx, ecx
mov word [esi + 0x20], cx
jmp 0x51abfe
mov edx, 1
mov word [esi + 0x20], dx
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push edx
push edi
call fcn.0052a090
fild dword [esi + 4]
add esp, 4
fsubr qword [esp + 0x3c]
fst qword [esp + 0x34]
fild dword [esi + 8]
fsubr qword [esp + 0x44]
fst qword [esp + 0x4c]
fstp qword [esp + 8]
fstp qword [esp]
call fcn.00529e60
fld qword [0x632648]
add esp, 0x10
fadd st(1), st(0)
fxch st(1)
call fcn.005f9c80
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
mov dword [esi + 0x1c], eax
fdivr qword [0x6424a8]
fld qword [esp + 0x24]
fmul st(1)
fxch st(1)
fmul qword [esp + 0x3c]
fldz
fcom st(2)
fnstsw ax
fxch st(2)
test ah, 0x41
jp 0x51ac78
fadd st(3)
jmp 0x51ac7a
fsub st(3)
call fcn.005f9c80
fcom st(1)
mov dword [esi + 0x14], eax
fnstsw ax
fstp st(1)
test ah, 1
jne 0x51ac91
faddp st(1)
jmp 0x51ac93
fsubrp st(1)
call fcn.005f9c80
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51b240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x620378
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00523100
lea edi, [esi + 0x14]
mov ecx, edi
mov dword [esp + 0x18], 0
mov dword [esi], vtable.ZgeoArc.0
call fcn.005f2930
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x1c], edx
mov word [esi + 0x20], cx
mov edx, dword [esi + 0xc]
cmp edx, dword [esi + 4]
jne 0x51b2ca
mov edx, dword [esi + 0x10]
cmp edx, dword [esi + 8]
jne 0x51b2ca
or ecx, 2
mov word [esi + 0x20], cx
mov ecx, dword [esp + 0x24]
fild dword [esp + 0x2c]
mov edx, dword [ecx]
sub edx, dword [eax]
fdivr qword [0x6424a8]
mov ecx, dword [ecx + 4]
sub ecx, dword [eax + 4]
mov dword [esp + 0x2c], edx
fild dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
fmul st(1)
fild dword [esp + 0x2c]
fmulp st(2)
fldz
fcom st(1)
fnstsw ax
fld qword [0x632648]
test ah, 0x41
jp 0x51b30b
fadd st(2), st(0)
jmp 0x51b30d
fsub st(2), st(0)
fxch st(2)
call fcn.005f9c80
fcomp st(2)
mov dword [edi], eax
fnstsw ax
test ah, 0x41
jp 0x51b323
faddp st(1)
jmp 0x51b325
fsubp st(1)
call fcn.005f9c80
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x51e7d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x620478
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00523e00
add esp, 0xc
mov edi, eax
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [edi + 0x10]
lea ecx, [edi + 0x14]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 0x1c]
push ecx
lea ecx, [esi + 0x14]
mov dword [esp + 0x3c], 0
mov dword [esi + 0x1c], eax
call fcn.00521ad0
mov dx, word [edi + 0x20]
lea ecx, [esp + 0xc]
mov word [esi + 0x20], dx
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0xc], vtable.ZgeoArc.0
call fcn.00523110
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x520390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x628fb0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
call fcn.00523100
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x10]
mov edi, vtable.ZgeoLine.0
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.00523100
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x44]
cdq
sub eax, edx
mov esi, eax
push 0
sar esi, 1
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 1
call fcn.0051ff60
push 1
push esi
lea ecx, [esp + 0x14]
call fcn.0051ff60
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 0x1c], ecx
lea ecx, [esp + 0xc]
mov dword [eax + 0x18], edx
mov byte [esp + 0x3c], 0
mov dword [esp + 0xc], edi
call fcn.00523110
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x20], edi
call fcn.00523110
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 8
Function at 0x523e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6206d1
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x682d00]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x14], 0
cmp dword [esi], 1
mov dword [esp + 0x20], ebx
jne 0x523ea3
cmp dword [esi + 4], 0
jne 0x523ea3
cmp dword [esi + 8], 1
jne 0x523ea3
cmp dword [esi + 0xc], 0
jne 0x523ea3
fldz
sub esp, 8
mov eax, esp
fstp qword [eax]
lea ecx, [esi + 0x10]
mov dword [esp + 0x20], esp
call fcn.005ef760
test eax, eax
je 0x523ea3
push 1
lea ecx, [esp + 0x1c]
call fcn.00531510
mov ecx, dword [eax + 4]
mov edx, dword [esi + 0x1c]
imul ecx, dword [esi + 0x18]
imul edx, dword [eax]
cmp ecx, edx
jne 0x523ea3
push edi
mov ecx, ebx
call fcn.0051db50
jmp 0x523f8c
mov eax, dword [esi + 8]
imul eax, dword [esi]
test eax, eax
movzx eax, word [edi + 0x20]
jge 0x523ebe
mov ecx, eax
xor ecx, 1
and ecx, 0xfffffff9
movzx ebp, cx
jmp 0x523ec6
mov edx, eax
and edx, 0xfffffff9
movzx ebp, dx
test al, 2
je 0x523ed1
mov eax, 2
jmp 0x523ed5
cwde
and eax, 0xfffffffb
test al, 2
je 0x523edc
or ebp, 2
lea eax, [edi + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00524320
mov edx, dword [edi]
mov edx, dword [edx + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call edx
push eax
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.00524320
push eax
lea ecx, [edi + 4]
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.00524320
push eax
push ebp
lea ecx, [esp + 0x4c]
call fcn.0051d690
movzx eax, word [edi + 0x20]
mov esi, 1
mov dword [esp + 0x6c], esi
test al, 2
jne 0x523f6e
cwde
and eax, 0xfffffffb
cmp ax, 2
je 0x523f6e
test byte [esp + 0x5c], 2
jne 0x523f54
movsx eax, word [esp + 0x5c]
and eax, 0xfffffffb
cmp ax, 2
jne 0x523f6e
mov ecx, edi
call fcn.0051dfc0
fcomp qword [0x6325d8]
fnstsw ax
test ah, 5
jp 0x523f6e
and word [esp + 0x5c], 0xfffd
lea eax, [esp + 0x3c]
push eax
mov ecx, ebx
call fcn.0051db50
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], esi
mov byte [esp + 0x6c], 0
call fcn.0051b350
mov eax, ebx
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005f9aee
add esp, 0x5c
ret
Function at 0x526460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x620888
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
fld qword [0x6424d0]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
fstp qword [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
jle 0x5264f2
mov esi, dword [ebp + 8]
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
push esi
call fcn.005eea40
fild dword [edi + 0x10]
fcom st(1)
fnstsw ax
test ah, 0x41
jnp 0x526527
fsubrp st(1)
fcom qword [esp + 0x1c]
fnstsw ax
test ah, 5
jp 0x5264e7
mov ecx, dword [esi]
fstp qword [esp + 0x1c]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x5264e9
fstp st(0)
inc ebx
add esi, 8
cmp ebx, dword [ebp + 0xc]
jl 0x5264b1
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov edx, dword [edi]
mov edx, dword [edx + 0x50]
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0xc]
fstp st(1)
mov ecx, dword [esp + 0x10]
fstp st(0)
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00519db0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], 0
call fcn.005258d0
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.00519ea0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5267c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6208c0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebp
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ecx
inc esi
push eax
lea ecx, [esp + 0x30]
sar esi, 1
call fcn.0051fde0
mov edi, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
push edi
push ecx
push edx
lea ecx, [esp + 0x34]
mov dword [esp + 0x64], 0
call fcn.0052b950
mov ebp, eax
sub ebp, esi
test ebp, ebp
jle 0x5268a7
lea eax, [edi + 8]
push eax
push edi
lea ecx, [esp + 0x44]
call fcn.0051fde0
neg esi
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x44]
mov byte [esp + 0x60], 1
call fcn.00520670
mov edx, dword [eax]
mov dword [edi], edx
mov eax, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov dword [edi + 4], eax
mov byte [esp + 0x58], 0
call fcn.0051fe50
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], 0xffffffff
call fcn.0051fe50
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov eax, dword [edi + 8]
mov dword [edi], eax
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x28]
mov dword [edi + 4], eax
mov dword [esp + 0x58], 0xffffffff
call fcn.0051fe50
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc

Function at 0x527df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x620948
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.005ee5f0
xor edi, edi
lea ecx, [esi + 0x40]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.ZgeoVectorFontData.0
call fcn.005ebb00
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret