joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401233
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareMicrosoftXACT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012a6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.DebugEngine
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401293
cmp dword [ebp - 0x14], esi
je 0x401293
mov dword [ebp - 4], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
mov eax, 0x55eb54
jne 0x4012ab
mov eax, 0x55eb64
mov ebx, 0x69e6f4
push ebx
mov edi, 0x55eb74
push edi
push 1
push esi
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
push eax
call esi
test eax, eax
jge 0x4012da
cmp dword [ebp - 4], 0
je 0x4012da
push ebx
push edi
push 1
push 0
push 0x55eb64
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401fc1
Capabilities:
Read file on windows

Disassembly:
push edi
xor eax, eax
lea edx, [ecx + 0x24]
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 0x2c], eax
xor eax, eax
push edx
push eax
push dword [esp + 0x18]
mov dword [ecx + 0x30], eax
push dword [esp + 0x14]
mov dword [ecx + 0x34], eax
mov eax, dword [ecx + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
jne 0x402007
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
sete al
ret
mov al, 1
ret

Function at 0x4022dc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [0x5824bc], bl
jne 0x402325
push ebx
push ebx
push dword [esi + 0x10]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add dword [esi + 0x10], edi
cmp dword [ebp + 8], ebx
je 0x402321
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push esi
call dword [ebp + 8]
add esp, 0x10
xor eax, eax
jmp 0x40233c
push dword [ebp + 0x10]
mov eax, esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x69e680]
call fcn.0040224f
pop ebx
leave
ret
Function at 0x40233f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp byte [eax + 1], 0x3a
jne 0x402353
int3
push ebx
push eax
lea eax, [ebp - 0x108]
push eax
mov edx, 0xff
mov ecx, 0x69e570
call fcn.004025bb
xor ebx, ebx
cmp byte [ebp - 0x108], bl
pop ecx
pop ecx
lea eax, [ebp - 0x108]
je 0x40238a
cmp byte [eax], 0x2f
jne 0x402385
mov byte [eax], 0x5c
inc eax
cmp byte [eax], bl
jne 0x40237d
cmp dword [0x69e670], ebx
push esi
push edi
je 0x402408
cmp byte [ebp - 0x108], 0x64
je 0x4023a6
cmp byte [ebp - 0x108], 0x44
jne 0x402408
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x105]
call fcn.004024f5
test al, al
pop ecx
pop ecx
je 0x402408
call fcn.0040dbc4
mov edx, dword [eax]
push 0x10
push 0x1c
mov ecx, eax
call dword [edx + 0x14]
cmp eax, ebx
je 0x4023f2
mov ecx, dword [0x58e698]
mov dword [eax], 0x55ebc4
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x18], ebx
mov esi, eax
jmp 0x4023f4
xor esi, esi
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
shl eax, 0xa
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jmp 0x402475
mov al, byte [0x5824bc]
neg al
push ebx
sbb eax, eax
and eax, 0x60000000
add eax, 0x80
push eax
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402483
call fcn.0040dbc4
mov edx, dword [eax]
push 0x10
push 0x1c
mov ecx, eax
call dword [edx + 0x14]
cmp eax, ebx
je 0x402468
mov dword [eax], 0x55ebc4
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x18], ebx
mov esi, eax
jmp 0x40246a
xor esi, esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov dword [esi + 0x14], 0x400
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x40247e

Function at 0x4026c2
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp byte [0x69ef8a], 0
jne 0x4026d8
xor al, al
leave
ret
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4026d4
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._SystemRoot_ehomeehshell.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4026d4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4026d4
push 1
push 0
push 0
lea eax, [ebp - 0x208]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov al, cl
leave
ret
Function at 0x402737
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x21064
call fcn.0052fda0
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 2
mov dword [ebp - 0xc], eax
jne 0x4028da
mov edi, dword [eax + 4]
mov ecx, str._mediacenter
mov eax, edi
xor ebx, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402797
cmp dx, bx
je 0x402793
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402797
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x402771
xor eax, eax
jmp 0x40279c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4027ac
mov byte [0x69ef8a], 1
jmp 0x4028da
mov esi, 0xfffe
push esi
lea eax, [ebp - 0x1105e]
push ebx
push eax
mov word [ebp - 0x11060], bx
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp - 0x2105e]
push ebx
push eax
mov word [ebp - 0x21060], bx
call sub.MSVCR80.dll_memset
mov esi, 0x7fe
push esi
lea eax, [ebp - 0x85e]
push ebx
push eax
mov word [ebp - 0x860], bx
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp - 0x105e]
push ebx
push eax
mov word [ebp - 0x1060], bx
call sub.MSVCR80.dll_memset
mov eax, 0x400
push eax
lea ecx, [ebp - 0x1060]
push ecx
push eax
lea eax, [ebp - 0x860]
push eax
mov esi, 0x8000
push esi
lea eax, [ebp - 0x21060]
push eax
push 3
lea eax, [ebp - 0x11060]
push eax
push edi
call dword [sym.imp.MSVCR80.dll__wsplitpath_s]
add esp, 0x54
lea eax, [ebp - 0x21060]
push eax
lea eax, [ebp - 0x11060]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
push 7
call fcn.00527bd0
add esp, 0x10
mov ecx, eax
call fcn.00529700
lea ecx, [ebp - 0x11060]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x402891
cmp dx, bx
je 0x40288d
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x402891
add ecx, 4
add eax, 4
cmp dx, bx
jne 0x40286b
xor eax, eax
jmp 0x402896
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4028d3
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
lea ecx, [ebp - 0x5c]
call fcn.00527310
push 4
lea eax, [ebp - 0x5c]
push 0x69ef80
push eax
call fcn.00527fa0
add esp, 0xc
lea ecx, [ebp - 0x5c]
mov byte [ebp - 1], al
call fcn.00527430
cmp byte [ebp - 1], bl
je 0x4028da
inc dword [0x69ef80]
jmp 0x4028da
or dword [0x69ef80], 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4028df
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor al, al
cmp dword [ebp - 0x94], 6
jne 0x402945
and dword [ebp - 4], 0
cmp dword [0x69f310], 0
je 0x40293e
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x69f310]
cmp dword [ebp - 4], 0
setne al
leave
ret
Function at 0x402947
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x148
push esi
push edi
lea ecx, [esp + 0xa0]
call fcn.00526f20
lea ecx, [esp + 0xf0]
call fcn.00526f20
push str.Activision
lea ecx, [esp + 0xc]
call fcn.00527310
push eax
lea ecx, [esp + 0xa4]
call fcn.00527470
lea ecx, [esp + 8]
call fcn.00527430
push str.Spider_Man_FoF
lea ecx, [esp + 0xc]
call fcn.00527310
push eax
lea ecx, [esp + 0xf4]
call fcn.00527470
lea ecx, [esp + 8]
call fcn.00527430
mov esi, 0x94
push esi
xor edi, edi
lea eax, [esp + 0xc]
push 0
inc edi
push eax
mov dword [esp + 0x150], edi
mov dword [esp + 0x154], 0x69efc8
mov dword [esp + 0x158], 0xa
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 5
jne 0x402a0b
cmp dword [esp + 0x10], 2
jne 0x402a0b
mov eax, edi
jmp 0x402a0d
xor eax, eax
test al, al
sete al
mov byte [0x5824bc], al
lea eax, [esp + 0xa0]
push eax
call fcn.005285e0
test al, al
pop ecx
je 0x402ae4
push str.Rhino_Main_Tread
call fcn.00525e00
lea ecx, [esp + 0xc]
mov dword [esp], str.ResolutionX
call fcn.00527310
push 0x69e688
lea eax, [esp + 0xc]
mov esi, 0x595860
push eax
mov ecx, esi
call fcn.00528370
lea ecx, [esp + 8]
call fcn.00527430
push str.ResolutionY
lea ecx, [esp + 0xc]
call fcn.00527310
push 0x69e68c
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00528370
lea ecx, [esp + 8]
call fcn.00527430
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x692850
push 0x67
push edi
mov byte [0x69ee42], 0
call esi
push 0x64
push 0x6927e8
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00402b49
push dword [ebp + 0x14]
mov eax, edi
call fcn.00402cec
test eax, eax
pop ecx
je 0x402ae4
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [0x6927e0], eax
call fcn.00402737
call fcn.004da9d8
call fcn.004026c2
push 0
call dword [sym.imp.MSVCR80.dll__exit]
int3
Function at 0x40df82
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
jmp 0x40dfa9
test edi, edi
je 0x40dfae
movzx edx, byte [ecx]
movzx esi, byte [eax]
xor edx, esi
mov esi, dword [eax]
shr esi, 8
xor esi, dword [edx*4 + 0x58e1a0]
inc ecx
mov dword [eax], esi
dec edi
test cl, 3
jne 0x40df8d
cmp edi, 4
mov esi, ecx
jb 0x40e047
mov ecx, edi
shr ecx, 2
mov dword [ebp - 4], ecx
push ebx
mov edx, dword [esi]
movzx ecx, byte [eax]
movzx ebx, dl
xor ecx, ebx
mov ecx, dword [ecx*4 + 0x58e1a0]
mov ebx, dword [eax]
shr ebx, 8
xor ecx, ebx
mov dword [ebp + 8], edx
movzx ebx, cl
mov dword [eax], ecx
movzx edx, dh
xor ebx, edx
mov edx, dword [ebx*4 + 0x58e1a0]
movzx ebx, byte [ebp + 0xa]
shr ecx, 8
xor edx, ecx
movzx ecx, dl
mov dword [eax], edx
xor ecx, ebx
mov ecx, dword [ecx*4 + 0x58e1a0]
movzx ebx, byte [ebp + 0xb]
shr edx, 8
xor ecx, edx
movzx edx, cl
mov dword [eax], ecx
xor edx, ebx
shr ecx, 8
xor ecx, dword [edx*4 + 0x58e1a0]
add esi, 4
sub edi, 4
dec dword [ebp - 4]
mov dword [eax], ecx
jne 0x40dfc2
pop ebx
jmp 0x40e047
movzx ecx, byte [esi]
movzx edx, byte [eax]
xor ecx, edx
mov edx, dword [eax]
shr edx, 8
xor edx, dword [ecx*4 + 0x58e1a0]
dec edi
mov dword [eax], edx
inc esi
test edi, edi
jne 0x40e02f
pop edi
pop esi
leave
ret 4
Function at 0x41739a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa4
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0x90]
push dword [esi + 0x1c]
mov ebx, dword [esi + 0x18]
call fcn.0043a488
test al, al
pop ecx
je 0x4173ca
movzx eax, word [0x58e6d8]
jmp 0x4173cd
xor eax, eax
inc eax
movss xmm0, dword [0x559c80]
push dword [esi + 0x1c]
movzx eax, ax
cvtsi2ss xmm2, eax
movaps xmm1, xmm0
divss xmm1, xmm2
movss dword [esp + 0x24], xmm1
call fcn.0043a488
test al, al
pop ecx
je 0x4173ff
movzx eax, word [0x58e6da]
jmp 0x417402
xor eax, eax
inc eax
movzx eax, ax
cvtsi2ss xmm1, eax
mov eax, dword [edi + 0x84]
test al, 0x40
divss xmm0, xmm1
movss dword [esp + 0x18], xmm0
je 0x417424
movss xmm0, dword [edi + 0x74]
jmp 0x41742c
mov ecx, dword [edi + 0xc]
movss xmm0, dword [ecx + 0x40]
test ax, 0x200
movss dword [esp + 0x1c], xmm0
je 0x417442
movss xmm0, dword [edi + 0x80]
jmp 0x41744a
mov ecx, dword [edi + 0xc]
movss xmm0, dword [ecx + 0x4c]
mov ecx, eax
and ecx, 0x80
je 0x41745b
movss xmm1, dword [edi + 0x78]
jmp 0x417463
mov edx, dword [edi + 0xc]
movss xmm1, dword [edx + 0x44]
test ax, 0x100
addss xmm1, xmm0
movss xmm0, dword [0x55b520]
movaps xmm2, xmm0
subss xmm2, xmm1
movss dword [esp + 0x28], xmm2
je 0x417489
movss xmm1, dword [edi + 0x7c]
jmp 0x417491
mov eax, dword [edi + 0xc]
movss xmm1, dword [eax + 0x48]
test ecx, ecx
addss xmm1, dword [esp + 0x1c]
movss dword [esp + 0x2c], xmm1
je 0x4174a8
movss xmm1, dword [edi + 0x78]
jmp 0x4174b0
mov eax, dword [edi + 0xc]
movss xmm1, dword [eax + 0x44]
subss xmm0, xmm1
push 0
movss dword [esp + 0x28], xmm0
call fcn.0043a27d
push 0
push 6
pop eax
call fcn.0043a222
mov eax, dword [0x6975c0]
mov esi, dword [ebp + 8]
mov dword [0x6975b4], eax
mov eax, dword [0x69e834]
movss xmm0, dword [eax + 0x40]
push 0x10
pop ecx
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
addss xmm0, dword [esp + 0x88]
movss dword [esp + 0x88], xmm0
movss xmm0, dword [eax + 0x44]
addss xmm0, dword [esp + 0x8c]
movss dword [esp + 0x8c], xmm0
movss xmm0, dword [eax + 0x48]
addss xmm0, dword [esp + 0x90]
lea eax, [esp + 0x58]
push eax
movss dword [esp + 0x94], xmm0
call fcn.00410f24
movss xmm0, dword [esp + 0x28]
addss xmm0, dword [esp + 0x2c]
movss xmm1, dword [esp + 0x34]
addss xmm1, dword [esp + 0x24]
movss xmm2, dword [esp + 0x38]
subss xmm2, dword [esp + 0x2c]
movss dword [esp + 0x3c], xmm0
movss dword [esp + 0x44], xmm0
movss xmm0, dword [esp + 0x30]
subss xmm0, dword [esp + 0x24]
mov dword [0x6975b8], eax
add esp, 0xc
movss dword [esp + 0x34], xmm1
movss dword [esp + 0x3c], xmm0
movss dword [esp + 0x40], xmm2
movss dword [esp + 0x44], xmm0
movss dword [esp + 0x48], xmm2
movss dword [esp + 0x4c], xmm1
mov ecx, 0x55e18c
lea eax, [esp + 0x90]
movss xmm0, dword [ecx - 4]
movss xmm1, dword [ecx]
movss dword [eax], xmm0
movss dword [eax + 4], xmm1
add ecx, 0xc
add eax, 8
cmp ecx, 0x55e1bc
jl 0x4175a9
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x94]
push eax
mov eax, dword [0x69e834]
push 0x6938b0
push ebx
push dword [eax + 0x50]
call dword [0x69e838]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430ef6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor ecx, ecx
mov dword [0x694148], 0x1105
inc ecx
mov eax, 0x694148
push esi
mov edx, dword [eax]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, ecx
mov dword [eax + 4], esi
add eax, 4
inc ecx
cmp eax, 0x694b04
jl 0x430f09
mov dword [0x58df70], ecx
pop esi
ret

Function at 0x43beff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc4
push ebx
push esi
push edi
push 2
pop eax
xor edx, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
push 3
pop eax
xor ecx, ecx
inc ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x1c], edx
jmp 0x43bf44
xor edx, edx
xor ebx, ebx
cmp dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
setne bl
mov dword [esp + 0x14], eax
add ebx, 4
shl ebx, 4
add ebx, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
movss xmm1, dword [ebx]
xorps xmm0, xmm0
movss dword [esp + 0x50], xmm1
movss xmm1, dword [ebx + 4]
movss dword [esp + 0x60], xmm1
movss xmm1, dword [ebx + 8]
movss dword [esp + 0x70], xmm1
movss xmm1, dword [ebx + 0xc]
shl ecx, 3
mov eax, dword [esp + ecx + 0x30]
mov ecx, dword [esp + ecx + 0x34]
movss dword [esp + 0x80], xmm1
shl eax, 4
add eax, dword [ebp + 8]
shl ecx, 4
movss xmm2, dword [eax]
add ecx, dword [ebp + 8]
movss dword [esp + 0x54], xmm2
movss xmm2, dword [eax + 4]
movss dword [esp + 0x64], xmm2
movss xmm2, dword [eax + 8]
movss dword [esp + 0x74], xmm2
movss xmm2, dword [eax + 0xc]
movss dword [esp + 0x84], xmm2
movss xmm2, dword [ecx]
movss dword [esp + 0x58], xmm2
movss xmm2, dword [ecx + 4]
movss dword [esp + 0x68], xmm2
movss xmm2, dword [ecx + 8]
movss dword [esp + 0x78], xmm2
movss xmm2, dword [0x55b520]
movss dword [esp + 0x8c], xmm2
movss xmm2, dword [0x57f8dc]
movaps xmm3, xmm2
subss xmm3, xmm1
movss dword [esp + 0x5c], xmm0
movss dword [esp + 0x6c], xmm0
movss dword [esp + 0x7c], xmm0
movss dword [esp + 0x80], xmm0
movss dword [esp + 0x84], xmm0
movss dword [esp + 0x88], xmm0
movss dword [esp + 0x20], xmm3
movaps xmm1, xmm2
subss xmm1, dword [eax + 0xc]
lea eax, [esp + 0x50]
push eax
movss dword [esp + 0x28], xmm1
lea eax, [esp + 0x94]
movaps xmm1, xmm2
subss xmm1, dword [ecx + 0xc]
push eax
movss dword [esp + 0x30], xmm1
movss dword [esp + 0x34], xmm0
call fcn.00402fe3
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.0040300d
add dword [esp + 0x28], 0x10
mov esi, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x14
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jl 0x43bf5e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
mov eax, dword [esp + 0x14]
jl 0x43bf42
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43eb25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
call fcn.0043eb44
fld1
push dword [esp + 4]
mov eax, dword [esi]
push ecx
mov ecx, esi
fstp dword [esp]
call dword [eax + 4]
jmp fcn.0043ebef
Function at 0x450d4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xorps xmm3, xmm3
push ebx
push esi
lea esi, [edi + 4]
xor ebx, ebx
movss dword [esi], xmm3
movss dword [esi + 4], xmm3
movss dword [esi + 8], xmm3
cmp dword [edi + 0x14], ebx
mov dword [ebp - 4], ebx
jle 0x450dbe
lea ebx, [edi + 0x1c]
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x2f4]
movss xmm0, dword [eax + 4]
movss xmm1, dword [eax + 8]
movss xmm2, dword [eax]
inc dword [ebp - 4]
addss xmm0, dword [esi + 4]
addss xmm1, dword [esi + 8]
addss xmm2, dword [esi]
mov eax, dword [ebp - 4]
movss dword [esi], xmm2
movss dword [esi + 4], xmm0
movss dword [esi + 8], xmm1
add ebx, 4
cmp eax, dword [edi + 0x14]
jl 0x450d77
xorps xmm3, xmm3
xor ebx, ebx
xor edx, edx
cmp dword [edi + 0x18], ebx
jle 0x450e00
lea ecx, [edi + 0x3c]
mov eax, dword [ecx]
movss xmm0, dword [esi + 4]
movss xmm1, dword [esi + 8]
addss xmm0, dword [eax + 0x78]
addss xmm1, dword [eax + 0x7c]
add eax, 0x74
movss xmm2, dword [eax]
addss xmm2, dword [esi]
inc edx
movss dword [esi], xmm2
movss dword [esi + 4], xmm0
movss dword [esi + 8], xmm1
add ecx, 4
cmp edx, dword [edi + 0x18]
jl 0x450dc8
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x18]
movss xmm2, dword [esi + 8]
movss xmm0, dword [0x55b520]
cvtsi2ss xmm1, eax
divss xmm0, xmm1
movss xmm1, dword [esi + 4]
mulss xmm1, xmm0
mulss xmm2, xmm0
mulss xmm0, dword [esi]
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
movss dword [esi + 8], xmm2
cmp dword [edi + 0x14], ebx
movss dword [edi + 0x10], xmm3
mov dword [ebp - 8], ebx
jle 0x450eac
lea eax, [edi + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2e4]
fld dword [eax + 0xac]
movss xmm0, dword [edi + 0x10]
fstp dword [ebp - 0xc]
mov eax, dword [ebx]
mov ecx, ebx
movss dword [ebp - 0x10], xmm0
call dword [eax + 0x2f4]
mov ecx, esi
call fcn.00440898
fadd dword [ebp - 0xc]
movss xmm0, dword [ebp - 0x10]
fstp dword [ebp - 0xc]
comiss xmm0, dword [ebp - 0xc]
jae 0x450e96
movss xmm0, dword [ebp - 0xc]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 4], 4
movss dword [edi + 0x10], xmm0
cmp eax, dword [edi + 0x14]
jl 0x450e4d
xor ebx, ebx
cmp dword [edi + 0x18], ebx
mov dword [ebp - 4], ebx
jle 0x450f09
lea eax, [edi + 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
movss xmm0, dword [edi + 0x10]
lea eax, [ebx + 0x74]
mov ecx, esi
movss dword [ebp - 0x14], xmm0
call fcn.00440898
mov eax, ebx
call fcn.0047a938
movss dword [ebp - 0x10], xmm0
fadd dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x14]
fstp dword [ebp - 0xc]
comiss xmm0, dword [ebp - 0xc]
jae 0x450ef5
movss xmm0, dword [ebp - 0xc]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 8], 4
movss dword [edi + 0x10], xmm0
cmp eax, dword [edi + 0x18]
jl 0x450eba
pop esi
pop ebx
leave
ret
Function at 0x473694
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
cmp byte [esi + 4], 0
push edi
je 0x473864
cmp dword [ebp + 0xc], 0
je 0x473864
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x114]
fld dword [eax + 0x1c]
mov eax, dword [ebp + 0x10]
fstp dword [esp + 0x24]
movzx eax, word [eax]
mov dword [esp + 0x20], eax
movzx eax, ax
cvtsi2ss xmm0, eax
mulss xmm0, dword [0x57f940]
push ecx
lea eax, [esp + 0x44]
movss dword [esp], xmm0
push eax
call fcn.004030d7
fld dword [esp + 0x2c]
fstp dword [esp + 4]
lea eax, [esp + 0x48]
fld dword [ebp + 0x14]
fstp dword [esp]
push eax
push esi
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.00472091
mov esi, eax
mov eax, dword [ebp + 0xc]
lea edi, [esp + 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x74]
lea edi, [esp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
mov edi, esp
lea esi, [esp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0047a19b
mov esi, eax
cmp esi, 0xfffffffe
je 0x47377d
lea eax, [esp + 0x80]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0047a34d
mov eax, dword [ebp + 0xc]
push esi
call fcn.0047a32c
mov esi, eax
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x14]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x30]
push eax
movsd dword es:[edi], dword [esi]
call sub.d3dx9_33.dll_D3DXVec3TransformCoord
movss xmm0, dword [esp + 0x28]
subss xmm0, dword [esp + 0x34]
mov eax, dword [ebx]
movss dword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0x2c]
subss xmm0, dword [esp + 0x38]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [esp + 0x30]
subss xmm0, dword [esp + 0x3c]
mov ecx, ebx
movss dword [esp + 0x18], xmm0
call dword [eax + 0x2e8]
movss xmm1, dword [eax + 0x14]
mulss xmm1, dword [esp + 0x14]
add eax, 0x10
movss xmm0, dword [eax]
mulss xmm0, dword [esp + 0x10]
addss xmm1, xmm0
xorps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x4737f3
movss dword [esp + 0x10], xmm0
movss dword [esp + 0x14], xmm0
movss dword [esp + 0x18], xmm0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x3b0]
xorps xmm0, xmm0
mov dword [eax + 4], 0xa
and word [eax + 0x78], 0
movss dword [eax + 0x60], xmm0
movss dword [eax + 0x64], xmm0
add eax, 0x7c
movss dword [eax], xmm0
movss dword [eax + 4], xmm0
movss dword [eax + 8], xmm0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x3b0]
mov edi, eax
add edi, 0x50
lea esi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x388]
mov cx, word [esp + 0x20]
movss xmm0, dword [0x55b464]
mov word [eax + 8], cx
mov dword [eax + 4], 2
movss dword [eax + 0xc], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret