joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac5e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69de91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, 1
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi], 0x6ae7e0
mov dword [esp + 0x14], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
push fcn.0041e5d0
push 0x41dff0
push 5
mov byte [esp + 0x20], al
push 0x10
lea eax, [esi + 0x44]
push eax
call fcn.005bbc4b
lea ecx, [esi + 0x94]
mov byte [esp + 0x14], 2
call fcn.00511260
lea ecx, [esi + 0x568]
mov byte [esp + 0x14], 3
call fcn.00511260
lea ecx, [esi + 0xa3c]
mov byte [esp + 0x14], 4
call fcn.00511260
lea ecx, [esi + 0xf10]
mov byte [esp + 0x14], 5
call fcn.00514f30
or eax, 0xffffffff
mov dword [esi + 4], 0xf0
mov dword [esi + 8], 0xe1
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0xf7
mov dword [esi + 0x1e60], eax
mov dword [esi + 0x1e64], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x1e68], edi
mov dword [esi + 0x1e6c], edi
mov dword [esi + 0x1e70], edi
mov ecx, dword [0x21ecb80]
cmp ecx, edi
mov byte [esp + 0x14], 6
je 0x4ac71a
mov eax, dword [0x21ecb84]
sub eax, ecx
sar eax, 2
cmp eax, edi
je 0x4ac71a
mov dword [esi + 0x1e6c], edi
mov eax, dword [0x21ecb80]
mov ecx, dword [0x21ecb84]
cmp eax, ecx
je 0x4ac71a
mov edx, dword [esp + 8]
push edx
push edi
push edi
push ecx
push eax
call fcn.004ac160
add esp, 0x14
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ad3e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x69df9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
push edi
mov edi, 1
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebp
mov dword [esi], 0x6ae834
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
lea ecx, [esi + 0x38]
mov byte [esp + 0x1c], 1
call fcn.00511260
lea ecx, [esi + 0x50c]
mov byte [esp + 0x1c], 2
call fcn.00511260
lea ecx, [esi + 0x9e0]
mov byte [esp + 0x1c], 3
call fcn.00511260
mov eax, dword [0x6f355c]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x64
mov dword [esi + 4], eax
mov eax, dword [0x6f3560]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x37
push 0x128
mov byte [esp + 0x20], 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0xe1
mov dword [esi + 0x10], 0x77
mov dword [esi + 0xeb8], ebp
call fcn.005b9e72
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x4ad4df
lea eax, [ebx + 8]
push eax
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
call dword [0x6a84d0]
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], ebp
mov ecx, 0x41
xor eax, eax
lea edi, [ebx + 0x20]
rep stosd dword es:[edi], eax
mov dword [ebx + 0x124], ebp
mov edi, 1
jmp 0x4ad4e1
xor ebx, ebx
mov dword [esi + 0xeb4], ebx
push 0x40
mov dword [ebx], 0xc
mov ecx, dword [esi + 0xeb4]
push 0xd2
mov dword [ecx + 4], 0x64
mov edx, dword [esi + 0xeb4]
push 0x35
push 0x75
add edx, 8
push edx
call dword [0x6a84d4]
mov eax, dword [esi + 0xeb4]
add eax, 0x18
mov dword [eax], 0x75
mov dword [eax + 4], 0x35
mov eax, dword [0x705f3c]
push edi
push eax
mov ecx, 0x21ee674
call fcn.0051c570
push edi
mov ecx, 0x21ee674
call fcn.0051cb10
push edi
mov ecx, 0x21ee674
call fcn.0051c750
mov ecx, 0x21ee674
call fcn.0051e930
mov dword [0x8512e8], ebp
mov dword [0x705f58], edi
mov ecx, dword [esi + 0xeb4]
mov dword [ecx + 0x124], edi
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4bd730
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69e9f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6af07c
mov dword [esp + 0x14], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
push fcn.0041e5d0
push 0x41dff0
push 3
push 0x10
lea eax, [esi + 0xa4]
push eax
mov byte [esp + 0x28], 8
call fcn.005bbc4b
mov dword [esi + 0xd8], edi
mov dword [esi + 0xd4], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
lea ecx, [esi + 0xec]
mov byte [esp + 0x14], 0xa
call fcn.00511260
lea ecx, [esi + 0x5c0]
mov byte [esp + 0x14], 0xb
call fcn.00511260
lea ecx, [esi + 0xa94]
mov byte [esp + 0x14], 0xc
call fcn.00511260
mov dword [esi + 0x20], 1
mov ecx, dword [0x6f355c]
add ecx, 0xffffff00
mov dword [esi + 4], ecx
mov ecx, esi
mov byte [esp + 0x14], 0xd
mov dword [esi + 8], 0x80
mov dword [esi + 0xc], 0xb9
mov dword [esi + 0x10], 0x96
mov dword [esi + 0xe4], 0x3f800000
mov dword [esi + 0xe8], edi
call fcn.004bca90
mov ecx, esi
call fcn.004bd280
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4cf5c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69ed6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, 1
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi], 0x6af874
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
push fcn.005113d0
push fcn.00511260
push 7
mov byte [esp + 0x20], al
push 0x4d4
lea eax, [esi + 0x38]
push eax
call fcn.005bbc4b
lea ecx, [esi + 0x2204]
mov byte [esp + 0x14], 2
call fcn.00517610
lea ecx, [esi + 0x2274]
mov byte [esp + 0x14], 3
call fcn.00514f30
mov dword [esi + 0x31c4], edi
xor eax, eax
lea edi, [esi + 0x31ca]
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4cfce0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69ee4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6af898
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x30], 2
call fcn.005bbc4b
lea ecx, [esi + 0x9f0]
mov byte [esp + 0x1c], 3
call fcn.00517610
lea ecx, [esi + 0xa60]
mov byte [esp + 0x1c], 4
call fcn.00514f30
lea ecx, [esi + 0x19b0]
mov byte [esp + 0x1c], 5
call fcn.00514f30
lea ebp, [esi + 0x2c14]
mov ecx, ebp
mov byte [esp + 0x1c], 6
call fcn.00511260
push ebx
push 0x447a0000
xor eax, eax
mov byte [esi + 0x2c0e], bl
mov dword [esi + 0x2c10], ebx
mov byte [esi + 0x2900], bl
mov byte [esi + 0x2901], bl
lea edi, [esi + 0x2902]
mov ecx, 0xc3
push 0x21f4060
rep stosd dword es:[edi], eax
push str.ui_paper001.wav
mov ecx, 0x21f1d78
mov byte [esp + 0x2c], 7
call fcn.00524960
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push 5
push 0xe4
push ecx
push edx
mov ecx, ebp
call fcn.00512a00
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d6770
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69ef6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6afa94
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x28], 2
call fcn.005bbc4b
lea ecx, [esi + 0x9f0]
mov byte [esp + 0x14], 3
call fcn.00511260
lea ecx, [esi + 0xec4]
mov byte [esp + 0x14], 4
call fcn.00517610
lea ecx, [esi + 0xf34]
mov byte [esp + 0x14], 5
call fcn.00514f30
mov dword [esi + 0x1e88], ebx
mov dword [esi + 0x1e84], ebx
mov dword [esi + 0x1e8c], ebx
mov dword [esi + 0x1e90], ebx
mov byte [esi + 0x1e9c], 0xff
mov byte [esi + 0x1e9d], bl
mov dword [esi + 0x1ea0], ebx
mov dword [esi + 0x1ea4], ebx
mov dword [esi + 0x1ea8], ebx
mov dword [esi + 0x1eac], ebx
lea eax, [esi + 0x1e9c]
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
add eax, 0x14
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
add eax, 0x14
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [esp + 0x14], 7
mov byte [esi + 0x1ed8], 0xff
mov byte [esi + 0x1ed9], bl
mov dword [esi + 0x1edc], ebx
mov dword [esi + 0x1ee0], ebx
mov dword [esi + 0x1ee4], ebx
mov dword [esi + 0x1ee8], ebx
lea ecx, [esi + 0x1ff4]
call fcn.004221b0
mov ecx, dword [esp + 0xc]
mov byte [0x21e957e], bl
mov dword [0x21e9580], ebx
mov byte [0x21ecb4c], bl
mov dword [esi + 0x20a4], ebx
mov dword [esi + 0x1e94], ebx
mov byte [esi + 0x1ef1], bl
mov dword [esi + 0x20ac], ebx
mov byte [esi + 0x20a8], bl
mov byte [esi + 0x1eec], bl
mov byte [esi + 0x1eed], bl
mov byte [esi + 0x1eee], 1
mov byte [esi + 0x1eef], 0xff
mov byte [esi + 0x1ef0], 0xff
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov dword [esi + 0x1e98], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d7d40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69f091
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6afaf8
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.005113d0
push fcn.00511260
push 4
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x2c], 2
call fcn.005bbc4b
lea ecx, [esi + 0x1398]
mov byte [esp + 0x18], 3
call fcn.00511260
lea ecx, [esi + 0x186c]
mov byte [esp + 0x18], 4
call fcn.00517610
lea ecx, [esi + 0x18dc]
mov byte [esp + 0x18], 5
call fcn.00514f30
lea ecx, [esi + 0x2834]
mov byte [esp + 0x18], 6
call fcn.004221b0
mov dword [esi + 0x282c], ebx
mov byte [esi + 0x29e9], bl
mov dword [esi + 0xc], 0xff
mov dword [esi + 0x10], 0x1a1
xor eax, eax
lea edi, [esi + 0x29ea]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2a6a]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4d7f90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69f16a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6afb1c
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
lea ecx, [esi + 0x7c]
mov byte [esp + 0x14], 5
call fcn.004221b0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov byte [esi + 0x140], bl
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 4], 0x286
mov dword [esi + 8], 0x4d
mov byte [esi + 0x78], 0xff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4db4b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69f33d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x6afbf4
call fcn.004221b0
mov dword [esi + 0xec], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
lea ecx, [esi + 0xf8]
mov byte [esp + 0x14], 2
call fcn.00511260
lea ecx, [esi + 0x5cc]
mov byte [esp + 0x14], 3
call fcn.00511260
mov ecx, esi
mov byte [esp + 0x14], 4
mov byte [esi + 0x2f], bl
mov byte [esi + 0x30], 1
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xaa0], ebx
call fcn.004da8c0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xaa4], ebx
mov dword [esi + 0xc], 0xbb
mov dword [esi + 0x10], 0x131
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4e6cb0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xc
push ebp
mov ebp, ecx
mov ecx, dword [0x21ecfd8]
or eax, 0xffffffff
cmp ecx, eax
mov dword [esp + 0xc], ebp
je 0x4e6dd8
cmp dword [0x21ed0e0], eax
je 0x4e6dd8
fld dword [0x21ee03c]
push edi
call fcn.005ba9a8
mov ecx, ebp
mov edi, eax
call fcn.004e5bc0
cmp eax, 0xc8
jg 0x4e6d1a
mov eax, dword [ebp + 0x9e4]
mov ecx, dword [ebp + 0x9e0]
add eax, 0x9c
add ecx, 0x13
push eax
push ecx
lea ecx, [ebp + 0x16288]
call fcn.00533950
pop edi
pop ebp
add esp, 0xc
ret
mov eax, edi
cdq
push ebx
push esi
and edx, 0x1ff
add eax, edx
mov esi, 0x200
sub esi, edi
sar eax, 9
cmp esi, 0xc8
jle 0x4e6d3e
mov esi, 0xc8
and edi, 0x800001ff
jns 0x4e6d4e
dec edi
or edi, 0xfffffe00
inc edi
mov ebx, dword [ebp + 0x9e4]
mov dword [esp + 0x10], edi
add edi, esi
mov dword [esp + 0x14], edi
add ebx, 0x9c
xor edi, edi
shl eax, 4
lea ebp, [eax + ebp + 0x16288]
fild dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x9e0]
sub esp, 8
fmul dword [0x6adbf4]
add eax, 0x13
mov ecx, ebp
fstp dword [esp + 4]
fild dword [esp + 0x18]
fmul dword [0x6adbf4]
fstp dword [esp]
push 0x3f800000
push 0
push esi
push 0x200
push ebx
push eax
push 0xffffffffffffffff
call fcn.00533a80
add ebx, esi
add edi, esi
mov esi, 0xc8
sub esi, edi
add ebp, 0x10
cmp edi, 0xc8
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
jl 0x4e6d70
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x4ec1d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69f55c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6b060c
mov dword [esp + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea ebp, [esi + 0x38]
mov ecx, ebp
mov byte [esp + 0x18], 1
call fcn.00511260
lea ecx, [esi + 0x50c]
mov byte [esp + 0x18], 2
call fcn.00514f30
mov eax, 3
mov dword [esi + 0xc], 0xf4
cmp dword [0x6f3558], eax
mov byte [esp + 0x18], al
jne 0x4ec264
mov dword [esi + 0xc], 0x129
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
mov dword [esi + 0x10], 0x83
mov dword [esi + 0x145c], 0xffffffff
mov dword [esi + 0x1460], edi
cmp dword [0x6f3558], eax
push 0x20
push 1
jne 0x4ec2df
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x108
push eax
push ecx
jmp 0x4ec2ec
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push 0xda
push edx
push eax
mov ecx, ebp
call fcn.00512a00
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f96a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69f77a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, 1
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6b09ec
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 5
call fcn.00511260
lea ecx, [esi + 0x54c]
mov byte [esp + 0x18], 6
call fcn.004221b0
mov dword [esi + 0x824], edi
mov byte [0x859086], bl
cmp dword [esi + 0x824], ebx
mov byte [esi + 0x600], 1
mov byte [esi + 0x601], 0xff
mov byte [esi + 0x602], bl
mov dword [esi + 0x604], ebx
mov dword [esi + 0x718], edi
mov dword [esi + 0x5fc], ebx
mov dword [esi + 0x71c], ebx
je 0x4f9794
mov dword [esi + 0xc], 0x14d
mov dword [esi + 0x10], 0x17c
jmp 0x4f97a2
mov dword [esi + 0xc], 0xfb
mov dword [esi + 0x10], 0x152
xor eax, eax
lea edi, [esi + 0x724]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea edi, [esi + 0x7a4]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4fb700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69f865
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6b0a10
mov dword [esp + 0x14], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
push fcn.005113d0
push fcn.00511260
push 3
push 0x4d4
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x28], 2
call fcn.005bbc4b
lea ecx, [esi + 0xed0]
mov byte [esp + 0x14], 3
call fcn.00517610
lea ecx, [esi + 0xf40]
mov byte [esp + 0x14], 4
call fcn.00514f30
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x30], bl
mov dword [esi + 0x1e94], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret