joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5061b0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov ax, word [esi + 0x80]
cmp ax, 0x3e
push edi
je 0x5061fe
cmp ax, 0x3f
je 0x5061fe
cmp ax, 0x3a
je 0x5061fe
cmp ax, 0x3c
je 0x5061fe
cmp ax, 0x3b
je 0x5061fe
cmp ax, 0x3d
je 0x5061fe
cmp ax, 0x40
je 0x5061fe
cmp ax, 0x41
je 0x5061fe
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, 0x44
je 0x506239
cmp ax, 0x46
je 0x506239
cmp ax, 0x4a
je 0x506239
cmp ax, 0x54
je 0x506239
cmp ax, 0x48
je 0x506239
cmp ax, 0x42
je 0x506239
cmp ax, 0x3e
je 0x506239
cmp ax, 0x40
je 0x506239
mov ecx, esi
call fcn.0042ad60
test al, al
je 0x50623d
push 0x10
jmp 0x50623f
push 0x11
mov ecx, dword [esi + 0x1360]
call fcn.005ef7a0
mov ecx, dword [0x76ba40]
xor edi, edi
cmp ecx, edi
mov ebx, eax
je 0x5062b0
mov eax, dword [esi + 0x1360]
push edi
push edi
push 8
push edi
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
mov byte [esp + 0x2c], 0x18
mov word [esp + 0x34], 9
mov dx, word [eax + 0xd4]
push 0xc
lea eax, [esp + 0x30]
push eax
mov word [esp + 0x3e], dx
call fcn.00623b30
mov eax, dword [esi + 0x1360]
mov ecx, dword [eax + 0x174]
mov edx, dword [0x76ba40]
cmp ecx, dword [edx + 0xb18]
jne 0x5062b0
mov dword [eax + 0x174], 0xffffffff
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x1360]
or edx, 0x80
mov dword [esi + 0xb4c], edi
mov dword [esi + 4], edx
mov ecx, dword [eax + 0x2a8]
cmp ecx, edi
je 0x50630b
mov eax, ecx
mov dword [esp + 0x10], 0x3ea
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov ecx, dword [eax]
cmp ecx, edi
je 0x50630b
lea edx, [esp + 0x10]
push edx
push 0xb
push eax
call ecx
add esp, 0xc
cmp ebx, edi
je 0x50636a
movss xmm0, dword [0x68b4fc]
movss dword [esp + 0x10], xmm0
movss xmm0, dword [0x68b4fc]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [0x68b4fc]
movss dword [esp + 0x18], xmm0
movss xmm0, dword [0x68b500]
movss dword [esp + 0x1c], xmm0
movaps xmm0, xmmword [esp + 0x10]
shufps xmm0, xmm0, 0x39
movaps xmm1, xmm0
shufps xmm1, xmm0, 0x39
movaps xmm2, xmm1
shufps xmm2, xmm1, 0x39
movaps xmmword [ebx + 0x10], xmm2
movaps xmmword [ebx + 0x20], xmm1
movaps xmmword [ebx + 0x30], xmm0
mov ecx, esi
call fcn.00504350
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x534bb0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x154
mov eax, dword [0x6d63d0]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x160], eax
mov eax, dword [edi + 0x88]
xor ebp, ebp
test eax, eax
mov bl, 1
lea esi, [edi + 0x94]
jle 0x534c68
mov ax, word [esi + 2]
test ax, ax
jl 0x534c03
mov ecx, dword [esi + 4]
movsx edx, word [esi]
push ecx
movsx eax, ax
push edx
push eax
mov ecx, 0x6de358
call fcn.004b9c50
test al, al
je 0x534c15
mov eax, dword [edi + 0x88]
inc ebp
add esi, 0x10
cmp ebp, eax
mov bl, 1
jl 0x534be0
jmp 0x534c68
mov eax, dword [0x72c1e8]
xor bl, bl
test eax, eax
je 0x534c68
mov eax, dword [esi + 4]
test eax, eax
jne 0x534c38
movsx edx, word [esi]
lea ecx, [esp + 0x60]
push ecx
push edx
call fcn.004acd40
add esp, 8
movsx ecx, word [esi + 2]
mov edx, dword [edi + 0x84]
push eax
movsx eax, word [esi]
push eax
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x20]
push str.RC:_Cant_load_RC__d_Index:_d_ID:_d__s_n
push ecx
call fcn.00671a9a
add esp, 0x18
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [edi + 0x2fc]
cmp edi, 0xffffffff
je 0x534ccc
cmp edi, 5
je 0x534ca1
cmp edi, 6
je 0x534ca1
test bl, bl
je 0x534c9f
lea eax, [edi + edi*4]
cmp word [eax*4 + 0x6eb840], 0xfffe
lea eax, [eax*4 + 0x6eb838]
jne 0x534c9f
cmp dword [eax], 0
je 0x534c9f
mov bl, 1
jmp 0x534ca1
xor bl, bl
mov eax, dword [0x72c1e8]
test eax, eax
je 0x534ccc
test bl, bl
jne 0x534ccc
push edi
lea eax, [esp + 0x14]
push 0x69464c
push eax
call fcn.00671a9a
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
call fcn.00671b23
add esp, 0x154
ret
Function at 0x554c36
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x682588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov ecx, 4
mov dword [esi + 0x18], ecx
mov dword [esi + 0x7c], edi
lea eax, [esi + 0x60]
add eax, 0x30
mov dword [eax + 0x1c], edi
add eax, 0x30
mov dword [eax + 0x1c], edi
add eax, 0x30
mov dword [esp + 8], esi
mov dword [eax + 0x1c], edi
push edi
push 1
push edi
mov dword [esi + 0x14], ecx
push edi
mov ecx, esi
mov dword [esp + 0x24], edi
mov dword [esi], 0x694b38
call fcn.005faf40
push edi
push 3
push 2
lea eax, [esi + 0x120]
push 1
mov ecx, esi
mov dword [esi + 0x50], eax
call fcn.005faf40
push 8
push 0x40
lea ecx, [esi + 0xa120]
push 3
mov dword [esi + 0x80], ecx
push 2
mov ecx, esi
call fcn.005faf40
push edi
push 7
push 1
lea edx, [esi + 0x8120]
push 3
mov ecx, esi
mov dword [esi + 0xb0], edx
call fcn.005faf40
lea eax, [esi + 0x12120]
mov dword [esi + 0xe0], eax
push 0x800
mov ecx, esi
mov dword [esi + 0x13124], edi
call fcn.005fae70
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x56465c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [edi + 0x3b], cl
xor esi, dword [ebx]
cmp dh, byte [edx]
add esp, 4
pop esi
push edi
call 0x56465c
add byte [edi + 0x33], cl
cmp ecx, dword [esi + 0x3c]
inc edi
dec ebp
inc ebp
cmp dword [ecx - 0x7d], eax
les eax, [ecx + eax*4]
invalid
Function at 0x565e6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x565ea2
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x565eac
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x565ec3
mov edx, dword [ebp - 0x1a14]
mov dword [ebp - 0x3f8], edx
jmp 0x565ed4
jmp 0x565cad
cmp dword [ebp - 0x3f8], 0
je 0x565faf
push eax
sub eax, 0x2a86
xor eax, 0x5bd5
and eax, 0xc6a3
pop eax
push esi
push edi
add esp, 4
add esi, 0x1725
pop esi
push esi
push edx
add esp, 4
sub esi, 0xa174
xor esi, 0x6920
pop esi
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x1a18], ecx
push esi
push edx
add esp, 4
or esi, 0xc8b6
jmp 0x565f30
and esi, 0x13782
pop esi
push esi
sub esi, 0x2bdf
or esi, 0x1002d
and esi, 0x2ea1
or esi, 0x12d90
pop esi
mov edx, dword [ebp - 0x1a18]
mov dword [ebp - 0x1a1c], edx
lea eax, [ebp - 0x173c]
push eax
call dword [ebp - 0x1a1c]
test eax, eax
jne 0x565faf
push eax
call 0x565f7c
add byte [edi], bh
inc ecx
dec ebp
inc edx
cmp dword [eax + 0x39], ecx
add esp, 4
or eax, 0x14a7c
jmp 0x565f8e
call 0x565f9c
add byte [edi], bh
dec esi
aaa
inc ecx
cmp byte [eax + 0x3f], dl
xor eax, dword [ebx - 0x38a7fb3c]
mov dword [ebp - 0xabc], 0
invalid
jmp 0x565fb3
push edx
push edx
add esp, 4
add edx, 0x506d
pop edx
push esi
sub esi, 0xfc9d
or esi, 0x18d5
add esi, 0xc9b5
pop esi
push eax
add al, 0x81
ret 0x506d
Function at 0x5662ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0xf8de
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x5662f0
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x5660bb
mov dword [ebp - 0x2fc], 0
Function at 0x5bce70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x684dbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
push edi
push 0
push 0x7e
mov ecx, 0x6de358
call fcn.004ae200
mov esi, eax
test esi, esi
je 0x5bd041
push 0xcb
push 0x68b520
push 0x10
push 0x170
call fcn.0061fe40
mov edi, eax
mov edx, edi
xor eax, eax
mov ecx, 0x5c
add esp, 0x10
mov dword [esp + 0xc], edx
rep stosd dword es:[edi], eax
test edx, edx
mov dword [esp + 0xac], eax
je 0x5bceed
push eax
push esi
mov ecx, edx
call fcn.005bb4c0
mov esi, eax
jmp 0x5bceef
xor esi, esi
test esi, esi
mov dword [esp + 0xac], 0xffffffff
je 0x5bd041
push 0
push esi
mov ecx, 0x725b20
call fcn.005f2300
mov edi, dword [ebp + 8]
mov ax, word [edi + 0xc]
mov word [esi + 0x130], ax
call fcn.005f2050
fmul dword [0x68b54c]
push ecx
lea ecx, [esp + 0x24]
fstp dword [esp]
push ecx
call fcn.00603d20
add esp, 8
push eax
lea edx, [esp + 0x64]
push edx
lea ecx, [edi + 0x10]
call fcn.006020a0
movss xmm1, dword [0x68b500]
mov ecx, dword [ebp + 0xc]
movaps xmm0, xmmword [ecx]
movss dword [esp + 0x10], xmm1
movss xmm1, dword [0x68b4fc]
movss dword [esp + 0x14], xmm1
movss xmm1, dword [0x68b4fc]
movss dword [esp + 0x18], xmm1
movss xmm1, dword [0x68b4fc]
movss dword [esp + 0x1c], xmm1
movaps xmm1, xmmword [esp + 0x10]
shufps xmm1, xmm0, 0xe0
shufps xmm0, xmm1, 0x24
movaps xmmword [eax + 0x30], xmm0
movaps xmm0, xmmword [eax]
movaps xmmword [esi + 0x10], xmm0
movaps xmm0, xmmword [eax + 0x10]
movaps xmmword [esi + 0x20], xmm0
movaps xmm0, xmmword [eax + 0x20]
movaps xmmword [esi + 0x30], xmm0
movaps xmm0, xmmword [eax + 0x30]
movaps xmmword [esi + 0x40], xmm0
movaps xmm0, xmmword [esi + 0x140]
shufps xmm0, xmm0, 0x55
mov dword [esp + 0xc], 0x3e4ccccd
lea eax, [esp + 0xc]
movss xmm1, dword [eax]
mulss xmm0, xmm1
movaps xmm1, xmmword [edi + 0x30]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x3d555555
movss xmm2, dword [edx]
shufps xmm2, xmm2, 0
mulps xmm1, xmm2
unpcklps xmm0, xmm1
push 0
push ecx
shufps xmm0, xmm1, 0xe1
movaps xmmword [esi + 0x140], xmm0
movaps xmm0, xmmword [ecx]
movaps xmmword [esi + 0x150], xmm0
mov eax, esp
mov dword [esp + 0x14], esp
mov dword [esi + 0x160], 0x41200000
push esi
mov ecx, 0x725b20
mov dword [eax], 0xc800
call fcn.005f2410
mov al, 1
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xa4]
pop edi
xor al, al
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e80a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc4
mov eax, dword [0x745080]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push ebx
push esi
push edi
xor esi, esi
shr eax, 8
push eax
push esi
push esi
push edx
lea ecx, [esp + 0x70]
mov word [esp + 0x7e], si
mov dword [esp + 0x74], esi
mov word [esp + 0x78], si
call fcn.005e5ae0
movzx eax, word [esp + 0x68]
cmp eax, esi
mov dword [esp + 0x18], esi
movss xmm0, dword [esp + 0x18]
shufps xmm0, xmm0, 0
mov dword [esp + 0x74], esi
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], esi
mov bl, 1
jle 0x5e819c
mov edi, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov ecx, dword [edi]
cmp word [ecx], 0
jne 0x5e818a
mov dx, word [ecx + 6]
cmp dx, 1
jbe 0x5e818a
mov eax, dword [ecx + 0xc]
mov esi, dword [eax + 2]
mov dword [esp + 0x40], esi
mov esi, dword [eax + 6]
mov dword [esp + 0x44], esi
mov esi, dword [eax + 0xa]
movzx eax, word [eax]
mov dword [esp + 0x48], esi
movaps xmm0, xmmword [esp + 0x40]
xor esi, esi
test dx, dx
movaps xmmword [esp + 0x50], xmm0
mov dword [esp + 0x18], eax
jbe 0x5e8163
call fcn.005e54d0
mov edx, dword [edi]
movzx eax, word [edx + 6]
inc esi
cmp esi, eax
jl 0x5e8153
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + 2]
mov eax, dword [ecx + 6]
movzx esi, word [ecx]
mov dword [esp + 0x30], edx
mov edx, dword [ecx + 0xa]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
movaps xmm0, xmmword [esp + 0x30]
movaps xmmword [esp + 0x20], xmm0
xor bl, bl
mov eax, dword [esp + 0x1c]
add edi, 4
dec eax
mov dword [esp + 0x1c], eax
jne 0x5e8111
lea ecx, [esp + 0x60]
call fcn.005e3ca0
test bl, bl
je 0x5e81b6
fld dword [0x68b4fc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [esp + 0x50]
mov eax, dword [esp + 0x18]
movaps xmm1, xmm0
sub esi, eax
shufps xmm1, xmm0, 0xaa
movaps xmm0, xmmword [esp + 0x20]
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
movaps xmm2, xmm0
pop edi
shufps xmm2, xmm0, 0xaa
subss xmm2, xmm1
movaps xmmword [esp + 0x1c], xmm2
fdivr dword [esp + 0x1c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f31a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x7452b8]
push edi
xor edi, edi
cmp eax, edi
je 0x5f31c3
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov eax, dword [0x7452b8]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x7452b8], edi
mov eax, dword [0x7452b0]
cmp eax, edi
je 0x5f31e3
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov eax, dword [0x7452b0]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x7452b0], edi
mov eax, dword [0x7452b4]
cmp eax, edi
je 0x5f3203
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov eax, dword [0x7452b4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x7452b4], edi
mov eax, dword [0x7452ac]
cmp eax, edi
je 0x5f323d
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 8]
mov esi, eax
cmp esi, edi
je 0x5f3236
push 0x30d
push 0x699f98
push esi
call fcn.005f27e0
add esp, 0xc
cmp esi, edi
jge 0x5f3236
push esi
call fcn.006731ab
mov dword [0x7452ac], edi
pop esi
pop edi
ret
Function at 0x5f7100
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov al, byte [ecx + 0x18]
push ebx
push ebp
push esi
xor esi, esi
test al, al
push edi
mov dword [esp + 0x10], ecx
je 0x5f71a0
mov eax, dword [esp + 0x1c]
push esi
push esi
push 3
push esi
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5f7148
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0xc2
mov ebp, eax
push str.c:_activision_truecrimeluxengine2LuxDefs.h
lea edi, [ebp + 4]
push 0x10
push edi
call fcn.0061fe40
mov esi, eax
add esp, 0x10
xor eax, eax
test esi, esi
je 0x5f71e7
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
push 0
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push esi
push edx
push eax
call dword [ecx + 0x12c]
push 0x1e7
push 0x69a830
push eax
call fcn.004f1d40
add esp, 0xc
test esi, esi
je 0x5f71e3
push 0xc3
push str.c:_activision_truecrimeluxengine2LuxDefs.h
push esi
call fcn.00620150
add esp, 0xc
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x5f7200
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push 0
push 0
push 3
push 0
push 1
push bind
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5f7232
xor eax, eax
pop ebx
add esp, 8
ret 4
push ebp
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0xc2
mov ebp, eax
push str.c:_activision_truecrimeluxengine2LuxDefs.h
lea edi, [ebp + 4]
push 0x10
push edi
call fcn.0061fe40
mov esi, eax
add esp, 0x10
xor eax, eax
test esi, esi
je 0x5f72c9
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
push 0
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push esi
push eax
call dword [edx + 0x15c]
push 0x20f
push 0x69a830
push eax
call fcn.004f1d40
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc3
push str.c:_activision_truecrimeluxengine2LuxDefs.h
push esi
call fcn.00620150
mov eax, dword [esp + 0x28]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x5fcfc0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x6d150d]
test al, al
je 0x5fd0ae
push ebx
mov ebx, dword [esp + 8]
cmp ebx, 0xffffffff
je 0x5fd0ad
mov eax, dword [esp + 0xc]
cmp eax, dword [0x749f28]
jge 0x5fd0ad
push esi
mov esi, dword [esp + 0x14]
imul esi, esi, 0x1c
shl eax, 4
add esi, dword [eax + 0x749d28]
je 0x5fd0ac
mov ecx, dword [esi + 8]
xor eax, eax
mov al, byte [esi + 4]
push edi
mov edi, ebx
and edi, 0xff
push eax
push ecx
call fcn.006701d0
add esp, 8
cmp eax, 0xfffffffe
mov dword [edi*4 + 0x748928], eax
jne 0x5fd059
push str.Reloading_Sound..._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push eax
call fcn.00670090
mov edx, dword [esi + 8]
xor ecx, ecx
mov cl, byte [esi + 4]
push ecx
push edx
call fcn.006701d0
add esp, 0x10
mov dword [edi*4 + 0x748928], eax
cmp dword [edi*4 + 0x748928], 0xfffffffd
je 0x5fd0ab
push 0
push 0x3f800000
push ebx
call fcn.005fcbf0
push 0
push 0x3f800000
push ebx
call fcn.005fcb80
mov eax, dword [edi*4 + 0x749128]
add esp, 0x18
test eax, eax
je 0x5fd08f
test al, 8
je 0x5fd0ab
push 0x3dcccccd
push 0
push 0x3f800000
push 0x427a0000
push 0
push ebx
call fcn.005fca50
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x60dc90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x68536b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push edi
mov edi, dword [esp + 0x74]
mov eax, dword [edi + 8]
test eax, eax
mov dword [esp + 8], 0
jne 0x60dcce
xor eax, eax
pop edi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret
push ebp
push esi
lea eax, [esp + 0x2c]
push eax
push 0
mov ecx, edi
call fcn.005f4b20
mov ecx, edi
call fcn.005f4680
cmp eax, 1
mov ebp, dword [esp + 0x88]
jne 0x60dcff
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], 1
jmp 0x60dd36
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.0060dc50
push ebp
mov esi, eax
call fcn.0060dc50
add esp, 8
cmp eax, esi
mov dword [esp + 0xc], eax
jl 0x60dd23
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x2c]
cmp eax, 0xc
jl 0x60dd36
cmp eax, 0xf
jg 0x60dd36
sub dword [esp + 0xc], 2
mov edx, dword [0x745834]
mov esi, dword [edx]
push ebx
lea ecx, [esp + 0x14]
push ecx
push 1
push eax
call fcn.0062c2f0
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x9c]
add esp, 4
push eax
mov eax, dword [0x745834]
push 0
push ebx
push edx
push ebp
push eax
call dword [esi + 0x50]
test eax, eax
jl 0x60deb1
xor esi, esi
test ebx, ebx
jle 0x60de68
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
lea esp, [esp]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x84]
push esi
call fcn.005f4b20
cmp ebp, 1
jb 0x60de54
cmp dword [esp + 0x90], 1
jb 0x60de54
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
lea ecx, [esp + 0x50]
push ecx
push esi
push eax
call dword [edx + 0x38]
mov edx, dword [esp + 0x80]
mov eax, dword [edx + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push esi
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x90]
push 0
push 3
lea ecx, [ebx + eax]
lea eax, [esp + 0x28]
push eax
push 0
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [edi + ebp]
push 0
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x34]
push 0
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
call fcn.0065416f
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x90]
shr edi, 1
shr ebx, 1
shr ebp, 1
shr eax, 1
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x60dd90
mov edi, dword [esp + 0x80]
push 0xc0
push str.c:_activision_truecrimeluxengine2LuxDefs.h
push 0x10
push 0x14
call fcn.0061fe40
add esp, 0x10
mov dword [esp + 0x80], eax
test eax, eax
mov dword [esp + 0x78], 0
je 0x60deb1
mov ecx, dword [esp + 0x14]
push ecx
push edi
mov ecx, eax
call fcn.005f4630
pop ebx
pop esi
pop ebp
pop edi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret
mov ecx, dword [esp + 0x70]
pop ebx
pop esi
pop ebp
xor eax, eax
pop edi
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x6189f0
Capabilities:
Terminate process

Disassembly:
push 0xdc
mov dword [0x768c48], 1
call fcn.00653e1a
test eax, eax
mov dword [0x745830], eax
jne 0x618a1e
push 1
mov dword [0x76b688], 2
call fcn.006731ab
push str.Direct3D_Object
push eax
push 0
mov ecx, 0x74584c
call fcn.0061da00
push 0x745840
call fcn.0062c220
mov eax, dword [0x76d574]
push eax
call fcn.0062b3d0
mov ecx, eax
add esp, 8
test ecx, ecx
mov dword [0x745844], ecx
je 0x618a6a
mov al, byte [ecx + 0x568]
test al, al
jne 0x618ac4
test dword [ecx + 0x470], 0x10000
jne 0x618ac4
mov eax, dword [0x76d574]
test eax, eax
je 0x618ae7
push 0
mov dword [0x76d574], 0
call fcn.0062b3d0
add esp, 4
test eax, eax
mov dword [0x745844], eax
je 0x618aae
mov cl, byte [eax + 0x568]
test cl, cl
je 0x618a9e
mov al, 1
jmp 0x618ab0
test dword [eax + 0x470], 0x10000
je 0x618aae
mov al, 1
jmp 0x618ab0
xor al, al
test al, al
sete al
test al, al
jne 0x618ae7
call fcn.0062db90
mov ecx, dword [0x745844]
mov al, byte [0x76d578]
test al, al
je 0x618af8
mov edx, dword [0x6d1518]
mov eax, dword [0x6d1514]
push edx
push eax
call fcn.0062ba80
call fcn.00618710
xor eax, eax
ret
push 1
mov dword [0x76b688], 3
call fcn.006731ab
mov edx, dword [0x6d151c]
mov eax, dword [0x6d1518]
push edx
mov edx, dword [0x6d1514]
push eax
push edx
call fcn.0062ac10
mov ecx, dword [0x745844]
push eax
call fcn.0062bbf0
call fcn.00618710
xor eax, eax
ret

Function at 0x618e10
Capabilities:
Terminate process

Disassembly:
push edi
call fcn.005fc460
call fcn.0061d770
mov eax, dword [0x6d1000]
mov edi, dword [eax]
test edi, edi
je 0x618eb5
push esi
call fcn.00618b30
mov ecx, 0x6d1010
call fcn.00618f70
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx*4 + 0x6d0fe4]
push edx
push 0x3f800000
push 0xa0
mov esi, eax
push 0x64
push esi
push edi
call fcn.0060cee0
push str.Press_ESC_to_exit.
push 0x3f800000
push 0xf0
push 0x64
push esi
push edi
call fcn.0060cee0
add esp, 0x30
mov ecx, esi
call fcn.0061a360
mov eax, dword [0x768c48]
push eax
call fcn.00618890
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
mov dword [0x6d1298], 1
jmp 0x618ea0
push 0x64
call esi
call fcn.005f4620
mov eax, dword [0x6d1298]
test eax, eax
jge 0x618ea0
pop esi
jmp 0x618ee9
mov ecx, dword [0x76b68c]
push 6
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0061fe60
mov edx, dword [esp + 8]
mov eax, dword [edx*4 + 0x6d0fe4]
mov ecx, dword [0x76b68c]
push 0x10
push str.TrueCrime:_Streets_of_L.A.___FATAL_ERROR
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.006731ab
pop edi
int3