joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062da
Capabilities:
Encode data using xor

Disassembly:
stc
pop ebx
sahf
insb byte es:[edi], dx
mov edi, 0x5ff987af
pop edx
xor edi, edx
xor edi, ebx
mov edx, 0x3b95fad0
mov ecx, 0x3b95fad0
xor ecx, edx
mov ebx, 0
mov edx, 0
xor ebx, edx
xor ecx, ebx
xor edi, ecx
xor ebx, ebx
add ebx, edi
mov edx, ebx
push edx
push 0x5c748f75
mov ebx, 0x5c748f75
pop esi
xor ebx, esi
xor ebx, esp
mov ecx, 4
sub esp, ecx
mov dword [esp], ebx
mov esi, 0x3b9a8fed
mov ebx, 0x3b9a8fed
xor ebx, esi
mov edi, 0
mov esi, 0
xor edi, esi
xor ebx, edi
mov edx, 0x8009c
mov esi, 0x8a41a22
xor edx, esi
push edx
mov edx, 0x1c74f1f8
mov ecx, 0x14d8eb06
xor ecx, edx
pop edi
xor ecx, edi
xor ebx, ecx
xor edx, edx
add edx, ebx
add esp, 0xfffffffc
mov esi, esp
mov dword [esi], edx
push 0x36903244
mov ecx, 0x71489d0
pop edi
xor ecx, edi
push 0x745831c1
mov esi, 0x45dc8a55
pop edx
xor esi, edx
xor esi, ecx
push 0x5dc40b61
mov ecx, 0x53478b2a
pop edx
xor ecx, edx
mov ebx, 0x41e92541
xor ebx, 0x4f6a310a
xor ebx, ecx
xor esi, ebx
mov edx, 4
sub esp, edx
mov ecx, 0
xor ecx, esp
mov dword [ecx], esi
push 0x2607eaab
mov ebx, 0x1f35ba6
pop ecx
xor ebx, ecx
mov ecx, 0x49481ba0
xor ebx, ecx
mov edi, 0x596a7782
mov ecx, 0x3796cd2f
xor ecx, edi
xor ebx, ecx
mov ecx, 0
xor ecx, ebx
add esp, 0xfffffffc
mov dword [esp], ecx
call eax
pop eax
push 0x7610ca0b
mov edx, 0x6f3864ba
pop esi
xor edx, esi
mov ecx, 0x4a0a5045
xor ecx, 0x5322fcf5
xor ecx, edx
push 0x725b5b6b
mov edx, 0x39184a73
pop esi
xor edx, esi
push edx
mov esi, 0x5f39ca74
mov ebx, 0x147ada48
xor ebx, esi
pop edi
xor ebx, edi
xor ecx, ebx
push 0x1a63f9d
mov edx, 0x2bbbb82b
pop edi
xor edx, edi
mov eax, 0x377c1e4e
xor eax, 0x13981a0a
xor eax, edx
mov esi, 0x51383167
xor esi, 0x16a1657c
push esi
mov ebx, 0x48009480
mov esi, 0x1202221
xor ebx, esi
pop edx
xor ebx, edx
xor ebx, eax
mov edx, 0x3fa896a3
xor edx, 0x73337110
mov esi, edx
xor esi, 0xffffffff
and esi, 0x100d30df
and edx, 0xeff2cf20
or edx, esi
mov esi, 0x1872054f
mov edi, 0x44041010
xor esi, edi
mov edi, 0x1a0c6600
mov eax, 0x1aac28fe
xor eax, edi
xor eax, esi
xor eax, edx
mov edi, ecx
mov esi, edi
xor edx, edx
add edx, esi
mov edi, 4
sub esp, edi
push esp
pop esi
mov dword [esi], edx
xor edx, edx
add edx, eax
mov esi, 0x32a4e2f6
xor esi, 0x32a4e2f2
sub esp, esi
mov dword [esp], edx
xor ecx, ecx
mov cl, byte [ebx]
add eax, ecx
mov cl, byte [eax]
pop eax
mov byte [ebx], cl
push 0xa6021cb0
mov esi, 0x59fde34f
pop edx
xor esi, edx
add ebx, esi
pop ecx
mov esi, 0x3f355370
mov edx, 0x3f355371
xor edx, esi
sub ecx, edx
xor edx, edx
add edx, ecx
and edx, edx
jne 0x40648e
mov ecx, 0x26fbd915
mov edi, 0x6e9fb33
xor edi, ecx
mov ecx, 0x6e7e9dcc
mov ebx, 0x6cbe09cc
xor ebx, ecx
xor edi, ebx
add esp, 0xfffffffc
mov ecx, esp
mov dword [ecx], edi
push 0x70cad2c9
mov edx, 0x655983d8
pop ebx
xor edx, ebx
mov ebx, 0x220d718d
mov eax, 0x150cc89e
xor eax, ebx
xor eax, edx
pop esi
xor eax, esi
call eax
pop eax
pop eax
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x40de38
nop
mov ecx, 0x420a365d
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6d8240aa
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x417000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46f030
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebp
mov ebp, dword [esp + 0x78]
test ebp, ebp
push esi
je 0x41705d
mov esi, dword [esp + 0x80]
test esi, esi
je 0x41705d
lea ecx, [esp + 0x44]
call fcn.00414510
push ebp
lea ecx, [esp + 0x48]
mov dword [esp + 0x74], 0
call fcn.004146e0
test al, al
jne 0x417070
lea ecx, [esp + 0x44]
mov dword [esp + 0x70], 0xffffffff
call fcn.00414560
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret
push ebx
push edi
mov ecx, 0x48f3c8
call fcn.004182f0
mov edx, dword [ebp]
mov edi, eax
mov eax, dword [esp + 0x50]
dec edi
mov ecx, ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
call dword [edx + 0x4c]
mov dword [esp + 0x88], eax
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x50]
mov ebx, dword [esp + 0x68]
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x38], vtable.org::CRect.0
mov ecx, esi
mov byte [esp + 0x78], 1
call fcn.004361f0
cmp dword [esp + 0x80], 1
jbe 0x4171ee
lea ecx, [esp + 0x4c]
call fcn.004147c0
test al, al
je 0x4170f3
or eax, 0xffffffff
jmp 0x4170fd
mov ecx, 0x48f3c8
call fcn.004182f0
mov ecx, eax
push eax
sub ecx, edi
mov dword [esp + 0x8c], ecx
mov ecx, esi
call fcn.00436230
mov al, byte [esi + 0x14]
test al, al
jne 0x417124
push 1
call dword [0x473318]
jmp 0x4171d8
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov edi, dword [esi + 0x28]
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], edi
call dword [0x473510]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
push 0
push eax
sub edi, eax
mov edx, dword [ebx]
push ecx
push edi
mov edi, dword [esp + 0x30]
sub edi, ecx
push edi
push eax
push ecx
push ebp
mov ecx, ebx
call dword [edx + 0x10]
lea eax, [esp + 0x18]
push ebx
push eax
mov ecx, esi
call fcn.004362a0
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x54]
sub ecx, edi
sub edx, ebp
push 0xcc0020
neg eax
sbb eax, eax
push edi
and eax, dword [esp + 0x60]
push ebp
push eax
push ecx
mov ecx, dword [esp + 0x24]
push edx
push edi
push ebp
mov edx, dword [ecx + 4]
push edx
call dword [0x4730f4]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x84]
xor eax, eax
mov byte [esi + 0x14], 0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x88]
cmp ecx, eax
jb 0x4170e1
mov ecx, esi
call fcn.00436210
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 0xffffffff
call fcn.00414560
mov ecx, dword [esp + 0x70]
pop edi
pop ebx
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x417dd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
mov al, byte [esi + 0x104]
fst qword [esp + 8]
cmp al, 0x2a
jne 0x417e05
mov ecx, esi
fstp st(0)
call fcn.0041ba20
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
fmul qword [esp + 8]
jmp 0x417de1
cmp al, 0x2f
jne 0x417e42
mov ecx, esi
fstp st(0)
call fcn.0041ba20
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
fcom qword [0x4745b0]
fnstsw ax
test ah, 0x40
jne 0x417e2c
fdivr qword [esp + 8]
jmp 0x417de1
push 0x48875c
fstp st(0)
call fcn.00452191
add esp, 4
push 1
call fcn.0045209e
cmp byte [esi + 0x104], 0x25
jne 0x417e76
mov ecx, esi
fstp st(0)
call fcn.0041ba20
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
call fcn.004521d4
fld qword [esp + 8]
mov esi, eax
call fcn.004521d4
cdq
idiv esi
mov dword [esp + 8], edx
fild dword [esp + 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417e83
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 0x104], 0x28
jne 0x417ecd
call fcn.0041ba20
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, byte [esi + 0x104]
fstp qword [esp + 4]
cmp al, 0x29
je 0x417ebd
push 0x48876c
call fcn.00452191
add esp, 4
push 1
call fcn.0045209e
mov ecx, esi
call fcn.0041ba20
fld qword [esp + 4]
pop esi
add esp, 8
ret
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10]
pop esi
add esp, 8
ret
Function at 0x418070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x48b194]
push esi
push edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
push ecx
call dword [0x4732e8]
call fcn.00417f90
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
test al, al
je 0x4181b6
mov al, byte [0x48f370]
test al, 1
jne 0x4180e6
mov dl, al
mov ecx, 0x48f360
or dl, 1
mov byte [0x48f370], dl
call fcn.0046547b
push 0x418250
call fcn.00451460
add esp, 4
mov al, byte [0x48f3c0]
test al, al
jne 0x41811e
mov edx, dword [str.ErrLog.txt]
push 0
push 1
push edx
mov ecx, 0x48f360
call fcn.0046562d
test eax, eax
je 0x418111
mov byte [0x48f3c0], 1
jmp 0x41811e
mov al, byte [0x48f3c0]
test al, al
je 0x4181b6
mov eax, dword [0x48f360]
push 2
push 0
mov ecx, 0x48f360
call dword [eax + 0x28]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x16]
mov eax, dword [esp + 0x14]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x16]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x16]
push eax
mov eax, dword [esp + 0x18]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x20]
push str._04d__02d__02d__02d:_02d:_02d
push ecx
call fcn.004605cd
mov eax, dword [esp + 0x28]
add esp, 0x20
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, 0x48f360
call fcn.00465784
push esi
lea edx, [esp + 0xc]
push edi
push edx
call fcn.004605cd
mov eax, dword [esp + 0x14]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, 0x48f360
call fcn.00465784
call fcn.00417f90
call fcn.00417f90
test al, al
je 0x418225
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x16]
mov edx, dword [esp + 0x14]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x16]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x16]
push edx
mov edx, dword [esp + 0x18]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x20]
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.004605cd
add esp, 0x20
lea ecx, [esp + 8]
push esi
push edi
push ecx
call fcn.004605cd
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.00462047
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x41ba20
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 4]
lea ebp, [ebx + 0x104]
mov dword [esp + 0x10], edi
mov esi, ebp
mov al, byte [edi]
cmp al, 0x20
je 0x41ba40
cmp al, 9
jne 0x41ba43
inc edi
jmp 0x41ba36
mov al, byte [edi]
test al, al
jne 0x41ba54
mov byte [ebp], al
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
push eax
push 2
mov ecx, ebx
call fcn.0041bba0
test eax, eax
je 0x41bac7
mov al, byte [edi]
mov byte [esi], al
mov cl, byte [edi + 1]
inc esi
inc edi
push ecx
push 3
mov ecx, ebx
call fcn.0041bba0
test eax, eax
je 0x41bab3
mov dl, byte [edi]
mov ecx, ebx
mov byte [esi], dl
mov al, byte [edi + 1]
inc esi
inc edi
push eax
push 2
call fcn.0041bba0
test eax, eax
je 0x41bb6b
mov al, byte [edi]
test al, al
je 0x41bb6b
mov byte [esi], al
mov cl, byte [edi + 1]
inc esi
inc edi
push ecx
push 3
mov ecx, ebx
call fcn.0041bba0
test eax, eax
jne 0x41ba79
push 0x488b98
call fcn.00452191
add esp, 4
push 1
call fcn.0045209e
movsx edx, byte [edi]
push edx
call fcn.00452533
add esp, 4
test eax, eax
je 0x41baf5
mov al, byte [edi]
mov byte [esi], al
inc esi
movsx ecx, byte [edi + 1]
inc edi
push ecx
call fcn.00452589
add esp, 4
test eax, eax
je 0x41bb6b
cmp byte [edi], 0
jne 0x41bad7
jmp 0x41bb6b
movsx edx, byte [edi]
push edx
call fcn.00452561
add esp, 4
test eax, eax
je 0x41bb3a
mov al, byte [edi]
mov byte [esi], al
inc esi
movsx ecx, byte [edi + 1]
inc edi
push ecx
call fcn.00452561
add esp, 4
test eax, eax
jne 0x41bb33
mov al, byte [edi]
cmp al, 0x2e
je 0x41bb33
movsx edx, al
push edx
call fcn.004523f8
add esp, 4
cmp eax, 0x45
jne 0x41bb6b
cmp byte [edi], 0
jne 0x41bb05
jmp 0x41bb6b
mov al, byte [edi]
cmp al, 0x27
je 0x41bb49
cmp al, 0x22
je 0x41bb49
mov byte [esi], al
inc esi
jmp 0x41bb6a
mov byte [esi], al
inc esi
mov cl, al
inc edi
mov al, byte [edi]
cmp al, 0x5c
jne 0x41bb5e
mov byte [esi], al
mov al, byte [edi + 1]
inc esi
inc edi
jmp 0x41bb62
cmp al, 0xa
je 0x41bb66
mov byte [esi], al
inc esi
inc edi
cmp byte [edi], cl
jne 0x41bb4f
inc edi
or ecx, 0xffffffff
xor eax, eax
mov byte [esi], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ebp
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41bba0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
dec ecx
je 0x41bc09
dec ecx
je 0x41bbe6
dec ecx
je 0x41bbc3
push str.iskanji:unknown_Kanji_code_type._n
call fcn.00452191
add esp, 4
push 1
call fcn.0045209e
mov ecx, dword [esp + 8]
cmp cl, 0x40
jb 0x41bbd1
cmp cl, 0x7e
jbe 0x41bc17
cmp cl, 0x80
jb 0x41bc1f
cmp cl, 0xfc
ja 0x41bc1f
and ecx, 0xff
mov eax, ecx
ret 8
mov ecx, dword [esp + 8]
cmp cl, 0x81
jb 0x41bbf4
cmp cl, 0x9f
jbe 0x41bc17
cmp cl, 0xe0
jb 0x41bc1f
cmp cl, 0xfc
ja 0x41bc1f
and ecx, 0xff
mov eax, ecx
ret 8
mov ecx, dword [esp + 8]
cmp cl, 0xa1
jb 0x41bc1f
cmp cl, 0xfe
ja 0x41bc1f
and ecx, 0xff
mov eax, ecx
ret 8
Function at 0x41c4a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
push edi
je 0x41c4ee
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x41c4ee
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41c4ee
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x41c4ee
cmp ecx, 8
jne 0x41c4ee
mov ecx, dword [esp + 0x14]
add ecx, 0xffffffeb
test esi, esi
jle 0x41c4e9
push ebx
sub ecx, eax
mov bl, byte [eax]
lea edx, [ecx + eax]
and edx, 7
mov dl, byte [edx + edi]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x41c4d5
pop ebx
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x420890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f6eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
push 0x80
call fcn.00461d88
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x4208d2
mov ecx, eax
call fcn.0041d8f0
mov edi, eax
jmp 0x4208d4
xor edi, edi
test edi, edi
mov dword [esp + 0x14], 0xffffffff
jne 0x420903
push edi
push str.FILED_MEMLOC
mov ecx, 0x48efa8
call fcn.00401bf0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [esi + 0x38]
push ebx
mov ebx, dword [esi + 0x30]
test eax, eax
jne 0x42093e
mov eax, dword [esi + 0x40]
push 0xc
lea ecx, [esi + 0x3c]
push eax
push ecx
call fcn.00460a60
mov ecx, dword [esi + 0x40]
add eax, 4
lea edx, [ecx + ecx*2]
dec ecx
test ecx, ecx
lea eax, [eax + edx*4 - 0xc]
jl 0x42093e
inc ecx
mov edx, dword [esi + 0x38]
mov dword [eax], edx
mov dword [esi + 0x38], eax
sub eax, 0xc
dec ecx
jne 0x420930
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
mov dword [esi + 0x38], ecx
mov dword [eax + 4], ebx
mov dword [eax], 0
mov ebx, dword [esi + 0x34]
inc ebx
mov dword [esi + 0x34], ebx
mov dword [eax + 8], 0
mov dword [eax + 8], edi
mov ecx, dword [esi + 0x30]
test ecx, ecx
pop ebx
je 0x42096c
mov dword [ecx], eax
jmp 0x42096f
mov dword [esi + 0x2c], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x422770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f8d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x10], esi
mov dword [esi], vtable.adv::ISound.0
push 0x422a20
push 0x422890
push 2
lea eax, [esi + 0x10]
push 8
push eax
mov dword [esp + 0x30], ebx
call fcn.00450f89
mov ecx, dword [esp + 0x24]
mov ebp, dword [0x4732cc]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], vtable.org::CString.0
lea edi, [esi + 0x74]
mov ecx, 7
xor eax, eax
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
mov byte [esi + 0x46], bl
mov byte [esi + 0x47], bl
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x68], bl
mov dword [esi], vtable.adv::CSound.0
mov dword [esp + 0x24], 4
rep stosd dword es:[edi], eax
lea edi, [esi + 0x58]
push ebx
push ebx
push 1
push ebx
call ebp
mov dword [edi], eax
mov eax, dword [esp + 0x24]
add edi, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x42281a
mov edi, dword [0x4732c8]
lea eax, [esi + 0x54]
push eax
push ebx
push esi
push 0x424370
push ebx
push ebx
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x50], eax
call ebp
lea edx, [esi + 0x78]
mov dword [esi + 0x7c], eax
push edx
push ebx
push esi
push 0x424390
push ebx
push ebx
call edi
mov dword [esi + 0x74], eax
lea eax, [esi + 0x90]
push eax
call dword [0x47331c]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x433060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4701c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ebx
push esi
push eax
lea eax, [esp + 0x18]
push edx
push eax
call fcn.004331b0
xor esi, esi
mov ebx, vtable.org::CBuffer.0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call dword [0x473918]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x28], 2
cmp eax, esi
mov dword [esp + 0x14], ebx
je 0x4330ca
push eax
call fcn.00461db1
add esp, 4
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x14]
call dword [edx + 0x68]
mov edx, dword [esp + 0xc]
cmp edx, esi
jne 0x433108
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 8], ebx
call dword [0x473938]
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jae 0x433149
push edx
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0xc], ebx
call fcn.00461db1
mov edx, dword [esp + 0xc]
add esp, 4
lea ecx, [esp + 8]
call dword [edx + 0x68]
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x30], 0xffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], ebx
call fcn.00461db1
mov edx, dword [esp + 0x10]
add esp, 4
lea ecx, [esp + 0xc]
call dword [edx + 0x68]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x435b10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47042e
push eax
mov eax, ecx
mov dword fs:[0], esp
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov byte [eax + 0x14], cl
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x18], vtable.org::CRect.0
mov dword [eax + 0x10], vtable.CUpdate.0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov ecx, dword [esp]
mov dword [eax], vtable.ver2::CSpriteCtrl.0
mov dword [eax + 0x10], vtable.ver2::CSpriteCtrl.1.0
mov dword fs:[0], ecx
add esp, 0xc
ret
Function at 0x436580
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4704d3
push eax
mov eax, ecx
mov dword fs:[0], esp
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov byte [eax + 0x14], cl
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x18], vtable.org::CRect.0
mov dword [eax + 0x10], vtable.CUpdate.0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov ecx, dword [esp]
mov dword [eax], vtable.CSpriteCtrl.1.0
mov dword [eax + 0x10], vtable.CSpriteCtrl.0
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x436ec0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4705d8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov al, byte [esi + 0x14]
cmp al, bl
je 0x436f42
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
push edi
mov edi, dword [esi + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], vtable.org::CRect.0
mov eax, dword [esi + 0x38]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00437000
mov byte [esi + 0x14], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov eax, dword [esi + 0x38]
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret