joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4648e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4968d0]
mov dword [ebp - 4], eax
jmp 0x4648f9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x464916
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x4648f0
mov esp, ebp
pop ebp
ret

Function at 0x464920
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4968e0], eax
je 0x46493e
mov eax, 0x10dd
jmp 0x464a1f
mov eax, dword [0x4968f0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4649bc
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x46499a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x46499a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00464a90
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00421260
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x464946
mov dword [0x4968f0], 0
call fcn.00464a30
mov ecx, dword [0x4968ec]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x464a09
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00421260
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x4649d4
mov dword [0x4968ec], 0
mov dword [0x4968e0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x464f90
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x464fa5
xor eax, eax
jmp 0x46501a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x464fd2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x465015
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x465013
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x46500f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x465013
xor eax, eax
jmp 0x46501a
jmp 0x464fc9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4650c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4968e4], 0
je 0x4650d9
mov eax, dword [0x4968e4]
jmp 0x465179
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x4650eb
xor eax, eax
jmp 0x465179
push 8
call fcn.00421226
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x465141
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x46512a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00421260
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x4968e4], eax
mov dword [0x4968e8], 0
mov eax, dword [ebp - 4]
jmp 0x465179
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x46515b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x46510b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x4968ec]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x4968ec], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4659a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00465a70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x465a5c
cmp dword [ebp - 4], 0x50000000
jb 0x4659dc
cmp dword [ebp - 4], 0x80000000
ja 0x4659dc
mov dword [ebp - 4], 0x80010000
jmp 0x4659b5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00451570
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x465a02
jmp 0x465a5c
cmp dword [ebp - 0x10], 0x10000
jne 0x465a45
cmp dword [ebp - 0x14], 0x10000
jb 0x465a45
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x465a38
mov eax, dword [ebp - 0x24]
jmp 0x465a5e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x465a57
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00465a70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4659b5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x465aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00465b70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x465b64
cmp dword [ebp - 4], 0x50000000
jb 0x465ae1
cmp dword [ebp - 4], 0x80000000
ja 0x465ae1
mov dword [ebp - 4], 0x4fff0000
jmp 0x465aba
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00451570
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x465b07
jmp 0x465b64
cmp dword [ebp - 0x10], 0x10000
jne 0x465b4a
cmp dword [ebp - 0x14], 0x10000
jb 0x465b4a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x465b3d
mov eax, dword [ebp - 0x24]
jmp 0x465b66
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x465b5f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00465b70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x465aba
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x465ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4968e0], eax
je 0x465bc5
mov eax, 0x10dd
jmp 0x465d5d
cmp dword [0x4968e4], 0
je 0x465bd8
mov eax, dword [0x4968e4]
jmp 0x465d5d
cmp dword [ebp + 8], 0
jne 0x465be8
mov eax, 6
jmp 0x465d5d
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x465c11
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x4968e4], ecx
mov edx, dword [ebp + 8]
mov dword [0x4968e8], edx
mov eax, dword [ebp - 0xc]
jmp 0x465d5d
push 0x18
call fcn.00421226
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x465c6a
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x4968e4], ecx
cmp dword [ebp - 0x18], 0
je 0x465c59
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00421260
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x4968e8], ecx
mov eax, dword [ebp - 0xc]
jmp 0x465d5d
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00464620
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00464620
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x465caa
cmp dword [ebp - 8], 0x1e
jbe 0x465cc6
mov dword [ebp - 0xc], 9
cmp dword [0x4968d8], 0
je 0x465cc1
jmp 0x465c3a
jmp 0x465c31
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x465ced
mov dword [ebp - 0xc], 9
cmp dword [0x4968d8], 0
je 0x465ce8
jmp 0x465c3a
jmp 0x465c31
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x465d1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x465c31
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4968f0]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x4968f0], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40b3c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x531560
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5857cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x34
call fcn.00521440
mov esi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x40b455
mov ecx, dword [edi + 4]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 8]
mov word [esi + 0x30], ax
mov dword [ebp - 4], eax
push edx
lea eax, [esi + 0xc]
mov dword [esi + 8], ecx
push eax
lea ecx, [edi + 0xd]
call fcn.0040b090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp + 8], eax
call dword [0x545468]
push 0x56c290
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.00521446
int3
Function at 0x410a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x531fa5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5857cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], vtable.pf::RemoteNotificationsListener.0
xor ebx, ebx
mov dword [edi], vtable.RemoteNotificationsService.1.0
mov dword [edi + 4], vtable.RemoteNotificationsService.0
mov dword [ebp - 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x28], 0xf
mov dword [edi + 0x24], ebx
mov byte [edi + 0x14], bl
lea esi, [edi + 0x30]
mov dword [ebp + 0xc], esi
mov dword [esi], ebx
push 8
mov byte [ebp - 4], 3
call fcn.00521440
add esp, 4
cmp eax, ebx
je 0x410b22
mov dword [esi], eax
xor edx, edx
mov dword [eax + 4], edx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [edi + 0x48], ebx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x20]
push ecx
mov eax, fcn.0049a850
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 8]
push 0x585b94
push edx
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call fcn.004108b0
add esp, 0xc
mov eax, dword [eax]
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x410ad8
inc dword [eax + 4]
mov ecx, dword [edi + 0x48]
or esi, 0xffffffff
mov dword [edi + 0x48], eax
cmp ecx, ebx
je 0x410af2
add dword [ecx + 4], esi
jne 0x410af2
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x410b0c
add dword [eax + 4], esi
mov ecx, eax
jne 0x410b0c
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], ebx
call dword [0x545468]
push 0x56c290
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.00521446
int3
Function at 0x411870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532108
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5857cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.004ef450
xor eax, eax
lea ecx, [esi + 0xc]
mov dword [esi], vtable.game::CompoSprite::Entry.0
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov dword [ebp - 4], eax
mov byte [ecx], al
lea eax, [edi + 0xc]
push eax
call fcn.00401a50
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x38]
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x40], ecx
fld dword [edi + 0x44]
fstp dword [esi + 0x44]
mov dl, byte [edi + 0x48]
mov byte [esi + 0x48], dl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x43d690
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5360e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5857cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
fld dword [0x546990]
mov eax, dword [ebp + 8]
fst dword [esi + 8]
mov dword [esi], 0xffffffff
fstp dword [esi + 0xc]
mov dword [esi + 4], 0xffffffff
fldz
xor ebx, ebx
fst dword [esi + 0x10]
fst dword [esi + 0x14]
fstp dword [esi + 0x18]
fld1
fst dword [esi + 0x1c]
fstp dword [esi + 0x20]
mov dword [esi + 0x24], eax
mov word [esi + 0x28], 0x101
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edi, 0xf
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0x40], bl
mov dword [esi + 0x8c], edi
mov dword [esi + 0x88], ebx
mov byte [esi + 0x78], bl
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.00478420
fld dword [0x546990]
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xb0], bl
mov dword [esi + 0xe0], edi
mov dword [esi + 0xdc], ebx
mov byte [esi + 0xcc], bl
mov dword [esi + 0xfc], edi
mov dword [esi + 0xf8], ebx
mov byte [esi + 0xe8], bl
fstp dword [esi + 0x110]
mov word [esi + 0x127], bx
mov dword [esi + 0x164], edi
mov dword [esi + 0x160], ebx
mov byte [esi + 0x150], bl
mov dword [esi + 0x180], edi
mov dword [esi + 0x17c], ebx
mov byte [esi + 0x16c], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43f850
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536573
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x5857cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x464], esi
call fcn.004ef430
xor ebx, ebx
mov dword [esi], vtable.MaskedImage.0
mov dword [esi + 0xc], edi
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, dword [edi]
mov edx, dword [eax + 0x7c]
mov ecx, edi
mov byte [ebp - 4], 4
call edx
test eax, eax
je 0x43f95e
mov eax, dword [edi]
mov edx, dword [eax + 0x7c]
mov ecx, edi
call edx
cmp eax, 2
je 0x43f95e
mov eax, dword [edi]
mov edx, dword [eax + 0x7c]
mov ecx, edi
call edx
cmp eax, 4
je 0x43f911
mov eax, dword [edi]
mov edx, dword [eax + 0x7c]
mov ecx, edi
call edx
cmp eax, 1
je 0x43f911
mov eax, dword [edi]
mov edx, dword [eax + 0x7c]
mov ecx, edi
call edx
cmp eax, 3
jne 0x43fa07
push 0x16
push str.2d_sprite_alpha_masked
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00401bf0
mov edx, dword [edi]
lea eax, [ebp - 0x48]
push eax
mov eax, dword [edx + 0x88]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, edi
mov byte [ebp - 4], 7
call eax
push eax
lea ecx, [ebp - 0x460]
call fcn.00462130
mov ecx, eax
call fcn.00411970
mov byte [ebp - 4], 8
jmp 0x43f9a9
push 0x14
push str.sprite_straightalpha
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00401bf0
mov edx, dword [edi]
lea eax, [ebp - 0x48]
push eax
mov eax, dword [edx + 0x88]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, edi
mov byte [ebp - 4], 5
call eax
push eax
lea ecx, [ebp - 0x460]
call fcn.00462130
mov ecx, eax
call fcn.00411970
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
push ebx
push eax
mov eax, dword [edx + 4]
call eax
cmp eax, ebx
je 0x43f9bc
inc dword [eax + 4]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x10], eax
cmp ecx, ebx
je 0x43f9d3
dec dword [ecx + 4]
jne 0x43f9d3
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov edi, 0x10
cmp dword [ebp - 0x34], edi
jb 0x43f9e9
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0052142e
add esp, 4
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xf
cmp dword [ebp - 0x18], edi
jb 0x43fa07
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0052142e
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521458
mov esp, ebp
pop ebp
ret 4
Function at 0x443c68
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
jmp 0x443b4d
xor ebx, 0xdf74
pop ebx
push eax
push edi
add esp, 4
sub eax, 0xf4f2
pop eax
push edi
and edi, 0x10b25
pop edi
push ecx
or ecx, 0x11276
add ecx, 0x5820
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push ebx
add esp, 4
add ebx, 0xf3ee
pop ebx
push edx
or edx, 0xbafd
call 0x443bd3
add byte [ebp + 0x32], al
dec ebp
cmp eax, dword ss:[ebx + 0x3a]
inc eax
inc ecx
add esp, 4
add edx, 0x114fc
xor edx, 0xf9e1
pop edx
mov dword [ebp - 0x10], 1
push edx
push ebx
add esp, 4
add edx, 0x2b4a
pop edx
push edx
push esi
add esp, 4
xor edx, 0x85fc
and edx, 0xa4bd
xor edx, 0x15ef
pop edx
push esi
or esi, 0x141a8
and esi, 0x4f47
pop esi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
call 0x443c55
add byte [edx], dh
xor eax, 0x44504342
add esp, 4
call 0x443c68
add byte [ecx + 0x32], al
cmp edi, dword [esi]
dec ebp
cmp byte [ebx], dh
push eax
dec esi
cmp eax, 0x8104c483
ljmp 0x6eb
Function at 0x44771f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x17e98
jmp 0x44772f
pop esi

Function at 0x447730
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + 0x3b], dl
inc ecx
inc eax
dec edx
push eax
and eax, 0x1bd8
pop eax
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x447780
push ecx
call 0x447759
add byte [0x374d444d], bh
cmp eax, 0x834b3c3a
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x35353432], bh
dec edi
cmp eax, 0x8104c483
loope 0x447719
sbb al, byte [ecx]
add byte [ecx + 0x51], bl
sub ecx, 0xd95f
pop ecx
jmp 0x4479ae
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push esi
push esi
add esp, 4
call 0x4477aa
add byte [edi], dh
dec ebp
push eax
xor al, 0x34
cmp cl, byte [eax + 0x4d]
add esp, 4
xor esi, 0x58eb
jmp 0x4477b9
or esi, 0x461c
pop esi
push edx
jmp 0x4477c7
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x44782f
push eax
push ebx
add esp, 4
sub eax, 0x13b75
add eax, 0x2138
sub eax, 0x11f3c
or eax, 0xb659
pop eax
push edx
and edx, 0x124b7
xor edx, 0x9e15
sub edx, 0x5d2a
pop edx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp fcn.00447960

Function at 0x447759
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + 0x3b], dl
inc ecx
inc eax
dec edx
push eax
and eax, 0x1bd8
pop eax
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x447780
push ecx
call 0x447759
add byte [0x374d444d], bh
cmp eax, 0x834b3c3a
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x35353432], bh
dec edi
cmp eax, 0x8104c483
loope 0x447719
sbb al, byte [ecx]
add byte [ecx + 0x51], bl
sub ecx, 0xd95f
pop ecx
jmp 0x4479ae
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push esi
push esi
add esp, 4
call 0x4477aa
add byte [edi], dh
dec ebp
push eax
xor al, 0x34
cmp cl, byte [eax + 0x4d]
add esp, 4
xor esi, 0x58eb
jmp 0x4477b9
or esi, 0x461c
pop esi
push edx
jmp 0x4477c7
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x44782f
push eax
push ebx
add esp, 4
sub eax, 0x13b75
add eax, 0x2138
sub eax, 0x11f3c
or eax, 0xb659
pop eax
push edx
and edx, 0x124b7
xor edx, 0x9e15
sub edx, 0x5d2a
pop edx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp fcn.00447960