joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ca60
Capabilities:
Get geographical location

Disassembly:
push 0x40
mov eax, 0x4ccf8f
call fcn.004ad025
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
push 0x3c
pop ecx
cdq
idiv ecx
push 0x3c
pop esi
push 5
xor ebx, ebx
mov edi, 0x400
mov word [ebp - 0x48], bx
mov word [ebp - 0x46], bx
mov word [ebp - 0x3a], bx
mov word [ebp - 0x42], bx
mov word [ebp - 0x44], bx
mov ecx, edx
cdq
idiv esi
mov word [ebp - 0x3c], cx
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push 0x1e
push edi
mov word [ebp - 0x40], si
mov word [ebp - 0x3e], dx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
cmp byte [ebp + 0x10], bl
mov dword [ebp - 4], ebx
jne 0x44cb33
cmp esi, ebx
jg 0x44cb33
lea eax, [ebp - 0x1c]
push eax
push str.mm_sss
lea esi, [ebp - 0x38]
call fcn.0044bd80
pop ecx
pop ecx
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x44caf3
lea eax, [ebp - 0x34]
push 0x800
mov esi, 0x5abde8
push esi
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44cb10
mov ecx, dword [ebp - 0x4c]
sub eax, edi
push eax
push esi
call fcn.0044c840
cmp dword [ebp - 0x20], 0x10
jae 0x4ea55f
call fcn.004ad0a8
ret
lea eax, [ebp - 0x1c]
push eax
push eax
push str.H_smm_sss
lea esi, [ebp - 0x38]
call fcn.0044bd80
add esp, 0xc
jmp 0x44cae7
push dword [ebp - 0x34]
call fcn.004a9db7
pop ecx
jmp 0x44cb2d

Function at 0x44e580
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp dword [0x5adde4], 0
push ebp
push esi
push edi
mov ebp, 0x800
mov esi, 0x5abde8
mov edi, 0x400
je 0x44e5e3
mov eax, dword [esp + 0x18]
and dword [0x5addd8], 0
cmp dword [eax + 0x18], 0x10
jae 0x4e78a1
add eax, 4
push ebp
push esi
push 0x5addd8
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x44e5ca
sub eax, ecx
mov ecx, dword [esp + 0x14]
push eax
push esi
call fcn.0044c840
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebp
push esi
push 0xe
push edi
call ebx
push eax
mov dword [esp + 0x14], eax
call fcn.004a9c7d
pop ecx
push esi
push dword [esp + 0x14]
mov dword [0x5adde4], eax
push eax
call fcn.004bf29f
push ebp
push esi
push 0xf
push edi
call ebx
push eax
mov dword [esp + 0x14], eax
call fcn.004a9c7d
pop ecx
push esi
push dword [esp + 0x14]
mov dword [0x5adde8], eax
push eax
call fcn.004bf29f
push ebp
push esi
push 0x12
push edi
call ebx
push esi
call fcn.004ab5c3
pop ecx
push ebp
push esi
push 0x10
push edi
mov dword [0x5adddc], eax
call ebx
push esi
call fcn.004ab5c3
pop ecx
push ebp
push esi
push 0x1010
push edi
mov dword [0x5adde0], eax
call ebx
push esi
call fcn.004ab5c3
pop ecx
mov dword [0x5addec], eax
pop ebx
jmp 0x44e59c
mov eax, dword [eax + 4]
jmp 0x44e5b4
Function at 0x44e9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c8209
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
xor edx, edx
mov dword [esp + 0x2c], edx
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ecx
mov byte [ebp + 4], dl
mov dword [esp + 0x44], edx
mov ecx, dword [eax + 0x10]
lea ebx, [eax + 0xc]
mov eax, dword [ecx + 4]
cmp byte [eax + 0x45], dl
mov dword [esp + 0x2c], 1
mov dword [esp + 0x20], ecx
jne 0x44eac1
mov ecx, dword [esp + 0x54]
mov edx, dword [ecx + 0x14]
mov esi, dword [ecx + 0x18]
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], esi
jmp 0x44ea6c
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
add ecx, 4
cmp esi, 0x10
jae 0x44eb9e
mov edi, ecx
mov ecx, dword [eax + 0x20]
cmp ecx, edx
jb 0x44ea83
mov ecx, edx
cmp dword [eax + 0x24], 0x10
jae 0x44eb96
lea esi, [eax + 0x10]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x44ea9b
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x44eaa6
jge 0x44eaaf
mov eax, dword [eax + 8]
jmp 0x44eab5
mov ecx, dword [eax + 0x20]
cmp ecx, dword [esp + 0x28]
jb 0x44eaa1
mov dword [esp + 0x20], eax
mov eax, dword [eax]
cmp byte [eax + 0x45], 0
je 0x44ea60
mov ecx, dword [esp + 0x20]
xor edx, edx
cmp ecx, dword [ebx + 4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ebx
je 0x44eb7b
mov edx, dword [ecx + 0x20]
mov esi, 0x10
cmp dword [ecx + 0x24], esi
jae 0x44eba5
lea edi, [ecx + 0x10]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax + 0x14]
cmp ecx, edx
mov dword [esp + 0x18], ecx
jb 0x44eaf7
mov ecx, edx
cmp dword [eax + 0x18], esi
jae 0x44ebad
add eax, 4
mov esi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x44eb10
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44eb77
cmp dword [esp + 0x18], edx
jb 0x44eb79
lea eax, [esp + 0x20]
xor edx, edx
mov esi, dword [eax]
cmp esi, edx
mov edi, dword [eax + 4]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
je 0x4e3919
cmp esi, ebx
jne 0x4e3919
cmp edi, eax
je 0x44eb8c
cmp esi, edx
je 0x4e3929
cmp edi, dword [esi + 4]
je 0x4e3935
push 0xffffffffffffffff
add edi, 0x28
push edx
push edi
mov ecx, ebp
call fcn.00448ee0
mov eax, ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0xc
jge 0x44eb1a
xor edx, edx
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x18]
jmp 0x44eb20
push 0xffffffffffffffff
push edx
mov edx, dword [esp + 0x38]
push edx
jmp 0x44eb58
mov esi, dword [eax + 0x10]
jmp 0x44ea90
mov edi, dword [ecx]
jmp 0x44ea7a
mov edi, dword [ecx + 0x10]
jmp 0x44eae6
mov eax, dword [eax + 4]
jmp 0x44eb03
call fcn.004a9ee6
mov eax, dword [esp + 0x1c]
xor edx, edx
jmp 0x44eb3c
call fcn.004a9ee6
xor edx, edx
jmp 0x44eb48
call fcn.004a9ee6
xor edx, edx
jmp 0x44eb51
Function at 0x453a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c7f5b
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5920a4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
and dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0xf
mov byte [esp + 0x28], 0
and dword [esp + 0x50], 0
mov ecx, dword [edx + 0x10]
mov eax, dword [ecx + 4]
add edx, 0xc
jmp 0x453ac0
mov edi, dword [esi + 0x14]
mov ecx, dword [eax + 0x20]
cmp ecx, edi
jb 0x453b04
jne 0x453c41
mov ecx, eax
mov eax, dword [eax]
mov dword [esp + 0x14], ecx
cmp byte [eax + 0x45], 0
jne 0x453b11
cmp dword [esi + 0x18], 0x10
jae 0x453bb6
lea ecx, [esi + 4]
mov edi, ecx
mov ecx, dword [eax + 0x20]
mov esi, dword [esi + 0x14]
cmp ecx, esi
jae 0x453b0d
cmp dword [eax + 0x24], 0x10
jae 0x453c22
lea esi, [eax + 0x10]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x453afb
sbb ebx, ebx
sbb ebx, 0xffffffff
test ebx, ebx
mov esi, dword [ebp + 8]
je 0x453aac
jge 0x453abc
mov eax, dword [eax + 8]
mov ecx, dword [esp + 0x14]
jmp 0x453ac4
mov ecx, esi
jmp 0x453ae3
cmp ecx, dword [edx + 4]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
je 0x453b5d
cmp dword [ecx + 0x24], 0x10
mov eax, dword [ecx + 0x20]
mov dword [esp + 0x14], eax
jae 0x453c39
lea edi, [ecx + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebx, eax
jb 0x453c32
cmp dword [esi + 0x18], 0x10
jae 0x453c2a
add esi, 4
mov ecx, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x453b57
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x453bbe
jge 0x453bca
mov eax, dword [edx + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
mov edi, dword [eax]
test edi, edi
mov esi, dword [eax + 4]
mov ebx, dword [edx + 4]
je 0x4e38bf
cmp edi, edx
jne 0x4e38bf
cmp esi, ebx
jne 0x453bd0
cmp dword [esp + 0x3c], 0x10
jae 0x4e38dd
fld dword [ebp + 0xc]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004a9c82
mov esp, ebp
pop ebp
ret 8
mov edi, dword [esi + 4]
jmp 0x453ad9
cmp ebx, dword [esp + 0x14]
jb 0x453b5d
jne 0x4e38b5
lea eax, [esp + 0x1c]
jmp 0x453b6c
test edi, edi
je 0x4e38c9
cmp esi, dword [edi + 4]
je 0x4e38d3
push 0xffffffffffffffff
push 0
add esi, 0x28
push esi
lea ecx, [esp + 0x30]
call fcn.00448ee0
cmp dword [esp + 0x3c], 0x10
mov eax, dword [esp + 0x28]
jae 0x453c01
lea eax, [esp + 0x28]
push eax
call fcn.004aa806
fstp dword [esp + 0x18]
pop ecx
push 0
push 1
lea ecx, [esp + 0x2c]
call fcn.00448860
fld dword [esp + 0x14]
jmp 0x453b96
mov esi, dword [eax + 0x10]
jmp 0x453af0
mov esi, dword [esi + 4]
jmp 0x453b4a
mov eax, ebx
jmp 0x453b3d
mov edi, dword [ecx + 0x10]
jmp 0x453b32
xor ebx, ebx
inc ebx
test ebx, ebx
jmp 0x453b02
xor eax, eax
inc eax
test eax, eax
jmp 0x453b5b
call fcn.004a9ee6
jmp 0x453b84
call fcn.004a9ee6
jmp 0x453bd8
call fcn.004a9ee6
jmp 0x453be1
push dword [esp + 0x28]
call fcn.004a9db7
pop ecx
jmp 0x453b93
Function at 0x4547c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c7f5b
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5920a4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x38], 0
mov esi, ecx
mov dword [esp + 0x3c], 0xf
mov byte [esp + 0x28], 0
and dword [esp + 0x50], 0
push eax
lea eax, [esp + 0x20]
push eax
add esi, 0xc
push esi
call fcn.00455ea0
mov edi, dword [eax]
test edi, edi
mov ebx, dword [eax + 4]
mov eax, dword [esi + 4]
mov dword [esp + 0x18], eax
je 0x4e38ec
cmp edi, esi
jne 0x4e38ec
cmp ebx, dword [esp + 0x18]
je 0x4548ab
test edi, edi
je 0x4e38f6
cmp ebx, dword [edi + 4]
je 0x4e3900
push 0xffffffffffffffff
push 0
add ebx, 0x28
push ebx
lea ecx, [esp + 0x30]
call fcn.00448ee0
cmp dword [esp + 0x3c], 0x10
mov eax, dword [esp + 0x28]
jae 0x454875
lea eax, [esp + 0x28]
push eax
call fcn.004ab5c3
cmp dword [esp + 0x40], 0x10
pop ecx
mov esi, eax
jae 0x4e390a
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004a9c82
mov esp, ebp
pop ebp
ret 8
push 0
push 1
lea ecx, [esp + 0x2c]
call fcn.00448860
mov eax, dword [ebp + 0xc]
jmp 0x45488b
call fcn.004a9ee6
jmp 0x45483e
call fcn.004a9ee6
jmp 0x45484c
call fcn.004a9ee6
jmp 0x454855
push dword [esp + 0x28]
call fcn.004a9db7
pop ecx
jmp 0x454889
Function at 0x4572a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8198
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5920a4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [esp + 0x40], 0
mov esi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
and dword [esp + 0x58], 0
push 8
push ecx
push 8
push eax
call fcn.004aa102
add esp, 0x10
push edi
lea eax, [esp + 0x28]
push eax
add esi, 0xc
push esi
call fcn.00455ea0
mov edi, dword [eax]
test edi, edi
mov ebx, dword [eax + 4]
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
je 0x4e3879
cmp edi, esi
jne 0x4e3879
cmp ebx, dword [esp + 0x20]
je 0x4573db
test edi, edi
mov eax, dword [esp + 0x14]
fld dword [eax]
fstp dword [esp + 0x1c]
fld dword [eax + 4]
fstp dword [esp + 0x14]
je 0x4e3883
cmp ebx, dword [edi + 4]
je 0x4e388d
push 0xffffffffffffffff
push 0
add ebx, 0x28
push ebx
lea ecx, [esp + 0x38]
call fcn.00448ee0
cmp dword [esp + 0x44], 0x10
mov eax, dword [esp + 0x30]
jae 0x457383
lea eax, [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
push str.__f____f
push eax
call fcn.004aa35e
fld dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
fstp dword [esi]
add esp, 0x10
fld dword [esp + 0x14]
fstp dword [esi + 4]
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.00448860
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004a9c82
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x18]
jmp 0x4573ac
call fcn.004a9ee6
jmp 0x457337
call fcn.004a9ee6
jmp 0x45735a
call fcn.004a9ee6
jmp 0x457363
Function at 0x463c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
je 0x4d8ff5
push esi
mov esi, dword [esp + 8]
push edi
mov edi, edx
cmp edi, 8
not esi
jae 0x463cb3
test edi, edi
je 0x463cac
jmp 0x463c90
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x549bf0]
add ecx, 1
sub edi, 1
jne 0x463c90
mov eax, esi
pop edi
not eax
pop esi
ret
push ebp
mov ebp, edi
shr ebp, 3
lea esp, [esp]
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
mov esi, esi
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
movzx edx, byte [ecx + 1]
xor edx, esi
and edx, 0xff
add ecx, 1
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
movzx edx, byte [ecx + 1]
xor edx, esi
and edx, 0xff
add ecx, 1
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
movzx edx, byte [ecx + 1]
xor edx, esi
add ecx, 1
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
movzx edx, byte [ecx + 1]
xor edx, esi
add ecx, 1
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
movzx edx, byte [ecx + 1]
xor edx, esi
add ecx, 1
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, esi
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, esi
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x549bf0]
add ecx, 1
sub edi, 8
sub ebp, 1
jne 0x463cc0
pop ebp
jmp 0x463c87
xor eax, eax
ret
Function at 0x46f980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ca384
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5920a4]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [esp + 0x14]
mov esi, ecx
call fcn.00461fc0
and dword [esp + 0x68], 0
push edi
lea ecx, [esp + 0x40]
call fcn.00450690
lea edi, [esp + 0x3c]
mov byte [esp + 0x68], 1
call fcn.0046e340
push 0xffffffffffffffff
push 0
mov eax, edi
push eax
lea ecx, [esp + 0x20]
call fcn.00448ee0
fld1
fdiv dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x34], eax
lea edi, [esi + 0xc]
mov eax, edi
fstp dword [esp + 0x38]
call fcn.0046f960
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.004784b0
lea eax, [esp + 0x14]
push eax
add esi, 0x1c
push esi
call fcn.004748e0
push 0
push 1
lea ecx, [esp + 0x44]
mov dword [eax], ebx
call fcn.00448860
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.00448860
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004a9c82
mov esp, ebp
pop ebp
ret 0x10
Function at 0x478650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c9335
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x5920a4]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, ecx
push str.color
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], esi
call fcn.0044be60
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esp + 0xd0], eax
lea eax, [esp + 0x5c]
push eax
call fcn.005083da
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x6c]
push ecx
mov ecx, eax
mov edx, esi
call fcn.00472870
mov esi, eax
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [esp + 0xc0], 0xffffffff
xor edi, edi
xor esi, esi
push edi
inc esi
push esi
lea ecx, [esp + 0x38]
call fcn.00448860
push str.blend
lea ecx, [esp + 0x7c]
call fcn.0044be60
push str.colorMode
lea ecx, [esp + 0x34]
mov dword [esp + 0xc4], esi
call fcn.0044be60
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x98]
push eax
push dword [esp + 0x18]
lea ecx, [esp + 0x84]
mov byte [esp + 0xcc], 2
call fcn.0044e9e0
push edi
push esi
lea ecx, [esp + 0x38]
call fcn.00448860
push edi
push esi
lea ecx, [esp + 0x80]
mov byte [esp + 0xc8], 5
call fcn.00448860
mov eax, 0x557a68
lea edx, [esp + 0x94]
call fcn.0045b6b0
test eax, eax
je 0x4e63ce
mov eax, str.multiply
lea edx, [esp + 0x94]
call fcn.0045b6b0
test eax, eax
je 0x4788b1
mov eax, str.blend
lea edx, [esp + 0x94]
call fcn.00478120
neg al
sbb eax, eax
and eax, 3
mov dword [ebx + 0x2c], eax
push str.blur
lea ecx, [esp + 0x50]
call fcn.0044be60
mov edx, dword [esp + 0x10]
mov byte [esp + 0xc0], 6
fldz
push ecx
fstp dword [esp]
lea eax, [esp + 0x50]
push eax
call fcn.00453a50
fstp dword [ebx + 0x1c]
push edi
push esi
lea ecx, [esp + 0x54]
mov byte [esp + 0xc8], 5
call fcn.00448860
push str.panSize
lea ecx, [esp + 0x18]
call fcn.0044be60
mov byte [esp + 0xc0], 7
fldz
push ecx
push ecx
fst dword [esp + 4]
lea eax, [esp + 0x70]
fstp dword [esp]
call fcn.004677c0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.004572a0
mov ecx, dword [eax]
mov dword [ebx + 0x20], ecx
mov eax, dword [eax + 4]
push edi
push esi
lea ecx, [esp + 0x1c]
mov dword [ebx + 0x24], eax
mov byte [esp + 0xc8], 5
call fcn.00448860
push str.scrollRate
lea ecx, [esp + 0x18]
call fcn.0044be60
mov edx, dword [esp + 0x10]
mov byte [esp + 0xc0], 8
fldz
push ecx
fstp dword [esp]
lea eax, [esp + 0x18]
push eax
call fcn.00453a50
fstp dword [ebx + 0x28]
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.00448860
push edi
push esi
lea ecx, [esp + 0x9c]
call fcn.00448860
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.004a9c82
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x2c], 2
jmp 0x4787a8
mov dword [ebx + 0x2c], esi
jmp 0x4787a8
Function at 0x479570
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x479592
call fcn.004795c0
cmp byte [esi + 0x40], 0
jne 0x4e975c
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4e97b7
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
jne 0x4e9767
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.00479d70
pop esi
ret
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov eax, dword [esi + 8]
test eax, eax
je 0x4e9772
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x190]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x4e97b3
cmp eax, 2
je 0x4795b0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4e9767
cmp eax, 3
je 0x4e979a
cmp eax, 1
jne 0x4e9767
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x4e9767
mov ecx, dword [esi + 0x11c]
add dword [eax + 8], ecx
jmp 0x4e9767
xor al, al
pop esi
ret
cmp eax, 0xcc
je 0x4795b9
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
jmp 0x4795b9
Function at 0x486950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d2add
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
xor esi, esi
push esi
call dword [eax + 0x20]
fldz
mov eax, dword [ebx + 0x68]
fst dword [eax + 0x38]
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x30], ecx
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x24], esi
mov dword [eax + 0x40], esi
mov dword [eax + 0x34], ecx
fstp dword [ebx + 0x264]
lea edi, [ebx + 0x238]
mov byte [ebx + 0x260], 1
mov dword [ebx + 0x270], esi
mov byte [ebx + 0x391], 0
call fcn.00406fb0
cmp byte [ebx + 0x18c], 0
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc]
jne 0x4869e5
cmp ecx, 1
je 0x4f37b5
fldz
fstp dword [ebx + 0x190]
fld dword [ebx + 0x190]
push ecx
fstp dword [esp + 0x18]
push ecx
fld dword [esp + 0x1c]
fstp dword [ebx + 0x198]
fld dword [esp + 0x1c]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp qword [esp]
call fcn.004aa640
fstp dword [esp + 0x1c]
pop ecx
fld dword [esp + 0x18]
pop ecx
call fcn.004c3ae0
mov esi, dword [ebx + 0x2e0]
push eax
call fcn.0044c910
fldz
fcomp dword [ebx + 0x190]
fnstsw ax
test ah, 5
jnp 0x486b10
xor cl, cl
mov eax, dword [ebx + 0x2e0]
push ecx
call fcn.00494620
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebx + 0x2e0]
push eax
push ecx
call fcn.00402550
mov edx, dword [0x5ac624]
lea ecx, [esp + 0x20]
call fcn.004050d0
xor esi, esi
mov dword [esp + 0x48], esi
mov edx, dword [ebx + 0x2e0]
push dword [edx + 0x1a8]
mov ecx, eax
call fcn.0044b4f0
or dword [esp + 0x48], 0xffffffff
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.00448860
push dword [ebx + 0x318]
call fcn.00486810
lea eax, [ebx + 0x340]
mov dword [ebx + 0x3b0], esi
call fcn.00491730
test al, al
je 0x4f37cf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov ebx, dword [ebx + 0x2d8]
lea eax, [ebx + 0x104]
fld dword [eax + 4]
push ecx
fstp dword [esp]
call fcn.00459e00
fmul qword [0x566760]
push ecx
lea eax, [esp + 0x20]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.004677c0
push eax
mov eax, ebx
call fcn.00434b30
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, 1
jmp 0x486a3f
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
lea eax, [ebx + 0x190]
fadd dword [eax]
fstp dword [eax]
jmp 0x4869e5
lea ecx, [ebx + 0x290]
call fcn.00404b00
cmp byte [ebx + 0x392], 0
mov eax, dword [eax]
mov ecx, dword [eax + 0x90]
jne 0x4f3809
cmp ecx, esi
jle 0x4f37ff
lea esi, [ecx - 1]
lea edi, [eax + 0x68]
call fcn.0048ddb0
mov eax, dword [eax + 4]
jmp 0x4f3801
xor eax, eax
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x40], eax
jmp 0x4f3815
mov eax, dword [ebx + 0x68]
mov ecx, dword [0x5ac620]
mov dword [eax + 0x40], ecx
lea ecx, [ebx + 0x340]
call fcn.00404b00
push dword [eax]
call fcn.0052e081
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
jmp 0x486afd