joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59d743
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x5a8aa8
mov dword [esp + 0x14], 1
call fcn.00463530
mov eax, dword [esi + 0x30]
mov edi, dword [eax]
cmp edi, eax
je 0x46b786
push ebx
mov ebx, edi
mov edi, dword [edi]
mov ecx, 0x5d5740
call fcn.00402360
mov eax, dword [0x5d5704]
mov ecx, 0x5d5740
mov dword [ebx], eax
mov dword [0x5d5704], ebx
call fcn.00443070
cmp edi, dword [esi + 0x30]
jne 0x46b75b
pop ebx
mov eax, dword [esi + 0x30]
mov ecx, 0x5d5740
mov dword [eax], eax
mov eax, dword [esi + 0x30]
mov dword [eax + 4], eax
mov edi, dword [esi + 0x30]
call fcn.00402360
mov ecx, dword [0x5d5704]
mov dword [edi], ecx
mov ecx, dword [esp + 0xc]
mov dword [0x5d5704], edi
mov dword [0x5d5740], 0
mov dword [esi], 0x5a8aa0
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4708d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x59da80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov ecx, 0x5d5740
lea edi, [esi + 0x8c]
mov dword [esp + 0x14], edi
mov dword [edi], ebp
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
call fcn.00402360
mov eax, dword [0x5d5700]
mov dword [esp + 0x20], ebp
cmp eax, ebp
jne 0x470975
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x14
push eax
push 8
call fcn.00403610
mov ecx, eax
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 1
mov dword [esp + 0x10], ecx
jne 0x470942
mov eax, ecx
jmp 0x47097d
add ecx, 8
push ebx
mov dword [0x5d5700], ecx
mov edx, ecx
add ecx, 8
mov ebx, 1
dec eax
cmp eax, ebx
je 0x47096c
mov dword [edx], ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
inc ebx
add ecx, 8
dec eax
cmp eax, ebx
jne 0x47095b
mov eax, dword [esp + 0x14]
mov dword [edx], ebp
pop ebx
jmp 0x47097d
mov ecx, dword [eax]
mov dword [0x5d5700], ecx
mov dword [0x5d5740], ebp
mov dword [edi], eax
mov dword [edi + 4], eax
add eax, 8
mov dword [edi + 8], eax
mov ecx, edi
mov dword [esp + 0x20], 3
call fcn.00402970
mov ecx, dword [esp + 0x18]
mov dword [esi], ebp
or eax, 0xffffffff
mov dword [0x5e00b8], ebp
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x28], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x78], ebp
mov dword [esi + 0x7c], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x88], 1
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x473c50
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push esi
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x473c76
push ebp
call dword [sym.imp.WS2_32.dll_ntohl]
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
ret 4
push edi
mov edi, str.255.255.255.255
mov ecx, 0x10
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x473c98
push 0xffffffffffffffff
call dword [sym.imp.WS2_32.dll_ntohl]
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
ret 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x473cbd
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
ret 4
mov dword [ebx], ebp
pop esi
pop ebp
pop ebx
ret 4
Function at 0x48f3d0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x59f164
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
lea esi, [ecx + 8]
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 0
lea edi, [esi + 0x294]
mov dword [esp + 0x10], edi
mov ecx, edi
mov byte [esp + 0x28], 6
call fcn.0049b620
mov edi, dword [edi]
push 0x18
push edi
mov byte [esp + 0x30], 5
call fcn.00402dc0
mov ecx, dword [esi + 0x250]
mov eax, dword [esi + 0x258]
add esp, 8
sub eax, ecx
test ecx, ecx
mov byte [esp + 0x28], 4
je 0x48f448
test eax, eax
je 0x48f448
push eax
push ecx
call fcn.00402dc0
add esp, 8
mov ecx, dword [esi + 0x244]
mov eax, dword [esi + 0x24c]
sub eax, ecx
mov byte [esp + 0x28], 3
test ecx, ecx
je 0x48f46d
test eax, eax
je 0x48f46d
push eax
push ecx
call fcn.00402dc0
add esp, 8
mov ecx, dword [esi + 0x220]
mov eax, dword [esi + 0x228]
sub eax, ecx
mov byte [esp + 0x28], 2
test ecx, ecx
je 0x48f492
test eax, eax
je 0x48f492
push eax
push ecx
call fcn.00402dc0
add esp, 8
mov edi, dword [esi + 0x214]
mov eax, dword [esi + 0x21c]
sub eax, edi
test edi, edi
je 0x48f4e1
test eax, eax
je 0x48f4e1
cmp eax, 0x80
jbe 0x48f4ba
push edi
call fcn.0050a62f
add esp, 4
jmp 0x48f4e1
add eax, 7
mov ecx, 0x5d5740
shr eax, 3
lea ebx, [eax*4 + 0x5d56fc]
call fcn.00402360
mov eax, dword [ebx]
mov ecx, 0x5d5740
mov dword [edi], eax
mov dword [ebx], edi
call fcn.00443070
lea edi, [esi + 0x70]
mov dword [esp + 0x18], edi
mov dword [edi], 0x5a9458
lea ecx, [edi + 0x50]
mov byte [esp + 0x28], 9
call fcn.0049b9f0
lea ebx, [edi + 0x44]
mov dword [esp + 0x1c], ebx
mov eax, dword [ebx + 4]
mov ebp, dword [ebx]
cmp ebp, eax
mov byte [esp + 0x28], 0xa
mov dword [esp + 0x10], eax
je 0x48f528
push ebp
call fcn.0049f2d0
mov eax, dword [esp + 0x14]
add ebp, 0x48
add esp, 4
cmp ebp, eax
jne 0x48f514
mov ecx, ebx
mov byte [esp + 0x28], 8
call fcn.0049ba40
lea ecx, [edi + 0x40]
mov byte [esp + 0x28], 7
call fcn.0049b9f0
mov ecx, edi
mov byte [esp + 0x28], 0
call fcn.004921f0
add esi, 0x44
mov dword [esp + 0x1c], esi
mov ecx, dword [esi + 0x18]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x28], esp
sub esp, 0x10
mov dword [esp + 0x48], 0xb
mov dword [eax], ecx
mov edx, dword [esi + 0x1c]
mov dword [eax + 4], edx
mov ecx, dword [esi + 0x20]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0x24]
mov dword [eax + 0xc], edx
lea eax, [esi + 8]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004ff4c0
call fcn.0049e6a0
add esp, 0x20
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.004d31b0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x4a0c30
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4a0c43
push eax
call fcn.0050c65f
add esp, 4
mov eax, dword [esp + 8]
push 0x8000
push eax
call fcn.0050ce29
add esp, 8
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4a0c9e
mov eax, dword [esi + 4]
test eax, eax
jne 0x4a0c73
push 0x2800
call fcn.0050a4f5
add esp, 4
mov dword [esi + 4], eax
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0x2800
push ecx
push edx
call fcn.0050c92f
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], eax
mov eax, dword [esi]
pop esi
ret 4

Function at 0x4a0cb0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov edi, eax
sub edi, ecx
cmp edi, 0x400
jge 0x4a0d20
cmp eax, 0x2800
jge 0x4a0cd6
test eax, eax
jl 0x4a0cd6
mov eax, edi
pop edi
pop esi
ret
test edi, edi
je 0x4a0cea
mov eax, dword [esi + 4]
push edi
add ecx, eax
push ecx
push eax
call fcn.0050a1c0
add esp, 0xc
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, 0x2800
add eax, edi
sub edx, edi
push edx
push eax
push ecx
call fcn.0050c92f
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
add ecx, edx
add esp, 0xc
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
add eax, edi
mov dword [esi + 0x10], 0
mov dword [esi + 8], ecx
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
pop edi
pop esi
ret

Function at 0x4a3a49
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5a066f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004e98b0
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esi + 0x34]
mov dword [esi + 0x30], 0x5a9aa0
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
push 0x18
mov byte [esp + 0x24], 4
mov dword [esi + 0x1a8], ebx
call fcn.00402b20
mov cl, byte [esp + 0x13]
mov dword [esi + 0x1a8], eax
mov dword [esi + 0x1ac], ebx
mov byte [esi + 0x1b0], cl
mov byte [eax], bl
mov edx, dword [esi + 0x1a8]
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x1a8]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x1a8]
mov dword [eax + 0xc], eax
lea edi, [esi + 0x1b4]
push 0x18
mov byte [esp + 0x28], 5
mov dword [esp + 0x1c], edi
mov dword [edi], ebx
call fcn.00402b20
add esp, 8
mov dword [edi], eax
mov al, byte [esp + 0xf]
mov ecx, edi
mov byte [esp + 0x20], 6
mov dword [edi + 4], ebx
mov byte [edi + 8], al
call fcn.004b4d30
mov dword [esi + 0x40c], ebx
mov dword [esi + 0x410], ebx
mov dword [esi + 0x414], ebx
mov ecx, esi
mov byte [esp + 0x20], 8
mov dword [esi], 0x5a9988
mov dword [esi + 0x30], 0x5a9900
call fcn.004a5750
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4a3b80
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a06ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004e98b0
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esi + 0x34]
mov dword [esi + 0x30], 0x5a9aa0
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
push 0x18
mov byte [esp + 0x20], 4
mov dword [esi + 0x1a8], ebx
call fcn.00402b20
mov cl, byte [esp + 0x30]
mov dword [esi + 0x1a8], eax
mov dword [esi + 0x1ac], ebx
mov byte [esi + 0x1b0], cl
mov byte [eax], bl
mov edx, dword [esi + 0x1a8]
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x1a8]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x1a8]
mov dword [eax + 0xc], eax
lea edi, [esi + 0x1b4]
push 0x18
mov byte [esp + 0x24], 5
mov dword [esp + 0x18], edi
mov dword [edi], ebx
call fcn.00402b20
add esp, 8
mov dword [edi], eax
mov al, byte [esp + 0x2c]
mov ecx, edi
mov byte [esp + 0x1c], 6
mov dword [edi + 4], ebx
mov byte [edi + 8], al
call fcn.004b4d30
mov dword [esi + 0x40c], ebx
mov dword [esi + 0x410], ebx
mov dword [esi + 0x414], ebx
mov ecx, esi
mov byte [esp + 0x1c], 8
mov dword [esi], 0x5a9988
mov dword [esi + 0x30], 0x5a9900
call fcn.004a5750
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push ecx
push edx
push edi
mov ecx, esi
call fcn.004a3ce0
push ebx
push edi
mov ecx, esi
call fcn.004a40c0
push ebx
push 0x10
push 1
push ebx
mov ecx, esi
call fcn.004a6270
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x4a40c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x574
test eax, eax
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x30]
je 0x4a40de
mov edx, dword [ecx]
push eax
call dword [edx + 0xc]
jmp 0x4a40e8
mov eax, dword [ecx]
push str.mface
call dword [eax + 0xc]
test eax, eax
je 0x4a4118
push 0
push eax
call fcn.0040ec30
lea ecx, [esp + 0x48]
lea edx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
lea edx, [esp + 0x30]
lea ecx, [esp + 0x24]
push edx
push ecx
push eax
call fcn.0040f470
add esp, 0x20
jmp 0x4a4178
mov dword [esp + 0x10], 0x3f333333
mov dword [esp + 0x14], 0x3f333333
mov dword [esp + 0x18], 0x3f333333
mov dword [esp + 0x1c], 0x3f333333
mov dword [esp + 0x20], 0x3f333333
mov dword [esp + 0x24], 0x3f333333
mov dword [esp + 0x28], 0x3f333333
mov dword [esp + 0x2c], 0x3f333333
mov dword [esp + 0x30], 0x3f333333
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x584]
lea eax, [esp + 0x40]
push 0
push eax
push ecx
call fcn.004a8d80
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov dx, word [0x5c6848]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
repne scasb al, byte es:[edi]
add esi, 0x19c
mov word [edi - 1], dx
lea eax, [esp + 0x240]
push eax
call fcn.0042a830
mov ecx, dword [esi + 4]
mov edi, dword [esi]
sub ecx, edi
lea edx, [esp + 0x44]
sar ecx, 2
push ecx
push edx
lea eax, [esp + 0x14c]
push str._s_02d
push eax
call fcn.005099e1
lea ecx, [esp + 0x154]
lea edx, [esp + 0x254]
push ecx
push edx
lea eax, [esp + 0x35c]
push str._s_s.
push eax
call fcn.005099e1
mov ecx, 0x50
xor eax, eax
lea edi, [esp + 0x464]
add esp, 0x24
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x440]
lea edx, [esp + 0x340]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x4a4295
push 0
push 0
push 0
push 0
lea eax, [esp + 0x150]
push 0
push eax
lea ecx, [esp + 0x4c]
push 0x42200000
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.0040eca0
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0x2c
cmp ecx, edx
mov dword [esp + 0xc], eax
je 0x4a4283
test ecx, ecx
je 0x4a427a
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x4a41b8
lea edx, [esp + 0xc]
push edx
push ecx
mov ecx, esi
call fcn.0049cd10
jmp 0x4a41b8
mov eax, dword [esi + 4]
mov edi, dword [esi]
sub eax, edi
xor ecx, ecx
sar eax, 2
cmp ecx, eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x574
ret 8
Function at 0x4abbe0
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a0b0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
call fcn.004b9bc0
lea ebx, [esi + 0x10]
xor ebp, ebp
mov ecx, ebx
mov dword [esp + 0x28], ebp
call fcn.0054eec0
lea ecx, [esi + 0x108]
mov byte [esp + 0x28], 1
call fcn.0054a880
lea ecx, [esi + 0x150]
call fcn.0054a880
lea ecx, [esi + 0x198]
call fcn.0054a880
lea edi, [esi + 0x1ec]
lea eax, [esp + 0x10]
push 8
push eax
mov ecx, edi
mov dword [esp + 0x24], edi
call fcn.00402a70
mov ecx, edi
mov byte [esp + 0x28], 2
call fcn.00402970
lea edx, [esp + 0x11]
lea ecx, [edi + 0xc]
push 8
push edx
mov byte [esp + 0x30], 3
mov dword [esp + 0x1c], ecx
call fcn.00402a70
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 4
call fcn.00402970
lea eax, [esp + 0x12]
lea ecx, [edi + 0x18]
push 8
push eax
mov byte [esp + 0x30], 5
mov dword [esp + 0x1c], ecx
call fcn.00402a70
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 6
call fcn.00402970
lea ecx, [edi + 0x58]
mov byte [esp + 0x28], 7
call fcn.00499fc0
mov dword [edi + 0x38], ebp
mov dword [edi + 0x54], ebp
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x48], ebp
mov dword [edi + 0x44], ebp
mov dword [edi + 0x40], ebp
mov dword [edi + 0x3c], ebp
mov dword [edi + 0x50], 0x64
mov dword [edi + 0x2c], 2
mov dword [edi + 0x30], 0x12c
mov dword [edi + 0x34], 3
lea ecx, [esi + 0x258]
mov byte [esp + 0x28], 8
call fcn.0054a880
lea ecx, [esi + 0x2a0]
call fcn.0054a880
lea ecx, [esi + 0x2e8]
call fcn.0054a880
lea ecx, [esi + 0x330]
call fcn.0054a880
lea edi, [esi + 0x388]
push 0x1c
mov dword [esp + 0x20], edi
mov dword [edi], ebp
call fcn.00402b20
add esp, 4
mov dword [edi], eax
mov cl, byte [esp + 0x12]
mov byte [esp + 0x28], 9
mov byte [edi + 8], cl
mov ecx, edi
mov dword [edi + 4], ebp
call fcn.004b4d30
lea edi, [esi + 0x394]
push 0x14
mov byte [esp + 0x2c], 0xa
mov dword [esp + 0x20], edi
mov dword [edi], ebp
call fcn.00402b20
add esp, 4
mov dword [edi], eax
mov dl, byte [esp + 0x12]
mov ecx, edi
mov byte [esp + 0x28], 0xb
mov dword [edi + 4], ebp
mov byte [edi + 8], dl
call fcn.004b4d30
lea edi, [esi + 0x3a4]
lea eax, [esp + 0x12]
lea edx, [esp + 0x11]
push eax
lea ecx, [edi + 4]
push edx
mov byte [esp + 0x30], 0xc
mov dword [esp + 0x24], edi
call fcn.004b4a70
lea eax, [esp + 0x10]
lea edx, [esp + 0x13]
push eax
lea ecx, [edi + 0x10]
push edx
mov byte [esp + 0x30], 0xd
call fcn.004b4ad0
mov dword [edi], 0x5a940c
mov dword [edi + 0x24], ebp
mov dword [edi + 0x20], ebp
mov dword [edi + 0x1c], ebp
mov ecx, esi
mov byte [esp + 0x28], 0xe
mov dword [esi], 0x5a9b90
mov dword [ebx], 0x5a9b70
call fcn.004abfc0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4b4378
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a1368
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
push 0
lea ecx, [esp + 0x10]
call fcn.0054ace0
mov eax, dword [esp + 0x2c]
push 0xc
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.0054ad60
lea ecx, [esp + 4]
push 7
push ecx
lea ecx, [esp + 0x10]
call fcn.0054ada0
fild dword [esp + 4]
lea edx, [esp + 4]
push 7
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9b5c]
fmul dword [0x5a83e8]
fadd dword [esi + 0x24]
fst dword [esi + 0x24]
fstp dword [esi]
call fcn.0054ada0
fild dword [esp + 4]
lea eax, [esp + 4]
push 7
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9b5c]
fmul dword [0x5a83e8]
fadd dword [esi + 0x28]
fst dword [esi + 0x28]
fstp dword [esi + 4]
call fcn.0054ada0
fild dword [esp + 4]
lea ecx, [esp + 4]
push 7
push ecx
lea ecx, [esp + 0x10]
fsub dword [0x5a9b5c]
fmul dword [0x5a83e8]
fadd dword [esi + 0x2c]
fst dword [esi + 0x2c]
fstp dword [esi + 8]
call fcn.0054ada0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0xc
push edx
lea ecx, [esp + 0x10]
fmul dword [0x5a9b58]
mov dword [esi + 0x14], 0
fld st(0)
fcos
fstp dword [esi + 0xc]
fsin
fstp dword [esi + 0x10]
call fcn.0054ada0
fild dword [esp + 4]
lea eax, [esp + 4]
push 0xc
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9b54]
fmul dword [0x5a8fac]
fstp dword [esi + 0x30]
call fcn.0054ada0
fild dword [esp + 4]
fsub dword [0x5a9b54]
fmul dword [0x5a8fac]
lea ecx, [esp + 4]
push 0xc
push ecx
lea ecx, [esp + 0x10]
fstp dword [esi + 0x34]
call fcn.0054ada0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0x10
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9b54]
fmul dword [0x5a8fac]
fstp dword [esi + 0x38]
call fcn.0054ada0
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push 0x10
push ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x3c], eax
call fcn.0054ada0
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [esi + 0x40], edx
mov dword [esp + 0x24], 0xffffffff
call fcn.0054ad40
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4b4528
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a1388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
push 0
lea ecx, [esp + 0x10]
call fcn.0054ace0
mov eax, dword [esp + 0x2c]
push 0xe
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.0054ad60
lea ecx, [esp + 4]
push 0xe
push ecx
lea ecx, [esp + 0x10]
call fcn.0054ada0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0xe
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9b50]
fmul dword [0x5a83e8]
fst dword [esi]
fstp dword [esi + 0x24]
call fcn.0054ada0
fild dword [esp + 4]
lea eax, [esp + 4]
push 0xc
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9b50]
fmul dword [0x5a83e8]
fst dword [esi + 4]
fstp dword [esi + 0x28]
call fcn.0054ada0
fild dword [esp + 4]
lea ecx, [esp + 4]
push 6
push ecx
lea ecx, [esp + 0x10]
fsub dword [0x5a9b4c]
fmul dword [0x5a83e8]
fst dword [esi + 8]
fstp dword [esi + 0x2c]
call fcn.0054ada0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0xb
push edx
lea ecx, [esp + 0x10]
fmul dword [0x5a83ec]
mov dword [esi + 0x14], 0
fld st(0)
fcos
fstp dword [esi + 0xc]
fsin
fstp dword [esi + 0x10]
call fcn.0054ada0
fild dword [esp + 4]
lea eax, [esp + 4]
push 0xb
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9b48]
fmul dword [0x5a9b44]
fstp dword [esi + 0x30]
call fcn.0054ada0
fild dword [esp + 4]
push 0xb
fsub dword [0x5a9b48]
fmul dword [0x5a9b44]
fstp dword [esi + 0x34]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
call fcn.0054ada0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0x10
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9b48]
fmul dword [0x5a9b44]
fstp dword [esi + 0x38]
call fcn.0054ada0
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push 0x10
push ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x3c], eax
call fcn.0054ada0
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [esi + 0x40], edx
mov dword [esp + 0x24], 0xffffffff
call fcn.0054ad40
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4bfbd0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5a1eb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004b9bc0
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
push 0x4c4850
push 0x5002a0
push 0x64
lea eax, [esi + 0x24]
push 0xc
push eax
mov byte [esp + 0x30], 1
call fcn.0050bc11
mov dword [esi + 0x4fc], edi
mov dword [esi + 0x500], edi
mov dword [esi + 0x504], edi
lea ebx, [esi + 0x50c]
push 8
mov byte [esp + 0x20], 3
mov dword [esp + 0x14], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.00402b20
mov dword [ebx], eax
mov dword [ebx + 4], eax
add eax, 8
add esp, 4
mov dword [ebx + 8], eax
mov ecx, ebx
mov byte [esp + 0x1c], 6
call fcn.00402970
mov dword [esi + 0x518], edi
mov dword [esi + 0x51c], edi
mov dword [esi + 0x520], edi
lea ecx, [esi + 0x524]
mov byte [esp + 0x1c], 8
call fcn.004f9600
mov dword [esi], 0x5aa5fc
mov byte [esp + 0x1c], 9
mov dword [0x66604c], esi
call fcn.00555a80
mov eax, 5
push str.Level
mov dword [esi + 0x570], edi
mov dword [esi + 0x574], edi
mov dword [esi + 0x578], eax
mov dword [esi + 0x57c], 0xf
mov dword [esi + 0x580], eax
mov dword [esi + 0x584], edi
mov dword [esi + 0x58c], edi
mov dword [esi + 0x598], edi
mov dword [esi + 0x590], edi
mov dword [esi + 0x4e4], edi
mov dword [esi + 0x4e0], edi
mov dword [esi + 0x4dc], edi
mov dword [esi + 0x4f0], edi
mov dword [esi + 0x4ec], edi
mov dword [esi + 0x4e8], edi
mov dword [esi + 0x4d8], edi
mov dword [esi + 0x4d4], edi
call fcn.004fc0b0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret