joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58c170
Capabilities:
Terminate process

Disassembly:
sub esp, 0x3c
cmp dword [0x7e43a0], 0
push ebx
push ebp
push esi
push edi
je 0x58c2b4
mov ax, word [0xa00422]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
movzx edi, word [0xa00420]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
mov word [esp + 0x24], ax
call esi
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
je 0x58c1e1
jmp 0x58c1c0
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
call ebp
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call esi
test eax, eax
jne 0x58c1c0
cmp dword [0x710d88], 0
je 0x58c2b4
mov dx, word [esp + 0x10]
mov word [0x9cdcd4], di
mov word [0x9cdcd6], dx
call fcn.0058b820
mov eax, dword [0x7e43a0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x7e4194
push eax
xor edi, edi
call edx
test eax, eax
je 0x58c295
mov edi, edi
cmp dword [0x93dca4], 0
jne 0x58c295
push 1
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
call esi
test eax, eax
je 0x58c261
lea esp, [esp]
lea ecx, [esp + 0x30]
push ecx
call ebx
lea edx, [esp + 0x30]
push edx
call ebp
push 1
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
call esi
test eax, eax
jne 0x58c240
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
cmp edi, 0xc8
jg 0x58c2bc
cmp dword [0x710d88], 0
jne 0x58c27f
xor edi, edi
mov eax, dword [0x7e43a0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x7e4194
push eax
call edx
test eax, eax
jne 0x58c220
call fcn.0058b6d0
call fcn.0058bc40
mov eax, dword [0x93d8ec]
test eax, eax
je 0x58c2aa
call eax
mov dword [0x93d8f0], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push 0x8081c4
call dword [sym.imp.USER32.dll_ClipCursor]
xor eax, eax
mov dword [0x710d38], 0
call fcn.00578cc0
mov ecx, eax
mov eax, 3
call fcn.00578cc0
push 0
push ecx
push eax
mov eax, dword [0x9cdcb8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.004abd17
int3

Function at 0x591120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [ecx]
xor eax, eax
test esi, esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
jbe 0x5911d0
add ecx, 4
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
test ecx, ecx
je 0x5911b8
lea edx, [ecx + 0x14]
mov ecx, dword [edx]
test ecx, ecx
je 0x5911b8
mov edi, edx
mov edx, dword [ecx + 0x30]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov bl, byte [ecx]
add ecx, 1
test bl, bl
jne 0x591160
sub ecx, esi
mov esi, ecx
or ecx, 0xffffffff
test edx, edx
je 0x5911a1
test esi, esi
je 0x59119f
jmp 0x591180
movzx ebp, byte [edx]
mov ebx, ecx
and ebx, 0xff
xor ebx, ebp
shr ecx, 8
xor ecx, dword [ebx*4 + 0x710748]
add edx, 1
sub esi, 1
jne 0x591180
not ecx
cmp ecx, dword [esp + 0x20]
je 0x5911d3
mov ecx, dword [edi + 4]
add edi, 4
add eax, 1
test ecx, ecx
jne 0x591157
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add dword [esp + 0x10], 4
add ecx, 1
cmp ecx, esi
mov dword [esp + 0x14], ecx
jb 0x591142
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x591360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [ecx + 0x30]
push ebx
add ecx, 0x30
test eax, eax
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
je 0x5913f3
mov eax, dword [eax + 4]
test eax, eax
je 0x5913e5
mov eax, dword [eax + 0x10]
test eax, eax
je 0x5913e5
mov eax, dword [eax + 8]
mov edi, dword [eax]
test edi, edi
je 0x5913e5
mov ebx, eax
mov ecx, dword [edi + 4]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x591398
sub eax, esi
mov edx, eax
or eax, 0xffffffff
test ecx, ecx
je 0x5913d1
test edx, edx
je 0x5913cf
movzx ebp, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, ebp
shr eax, 8
xor eax, dword [esi*4 + 0x710748]
add ecx, 1
sub edx, 1
jne 0x5913b0
not eax
cmp eax, dword [esp + 0x18]
je 0x5913fd
mov edi, dword [ebx + 4]
add ebx, 4
test edi, edi
jne 0x591390
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
add ecx, 4
test eax, eax
mov dword [esp + 0x10], ecx
jne 0x591377
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov eax, dword [edi + 0x14]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x592fb0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 0
push 0x592b00
push 0x20000
mov byte [esi + 0x20], 1
push 0
mov byte [esi + 0x21], 0
call fcn.004a9a93
add esp, 0x18
test eax, eax
jne 0x592fe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x592ff1
mov ecx, dword [esp]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], ecx
mov eax, 1
cmp eax, 1
sete dl
mov byte [esi + 0x22], dl
mov eax, dword [esi + 0x1c]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 0x1c]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov al, byte [esi + 0x22]
pop ecx
ret
Function at 0x5a8d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [esp + 8]
sub esp, 0x1c
shl eax, 0x1d
push esi
mov esi, dword [esp + 0x24]
xor eax, dword [esi + 0x60]
and eax, 0x20000000
xor dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
test eax, 0x8000000
jne 0x5a8e77
mov eax, 0x1a00
push ebx
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, 0x400
xor ebx, ebx
push edi
mov dword [esi + 0x54], ebx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov ebp, esi
lea ecx, [ecx]
cmp dword [0x9d3e94], 0
movzx eax, word [esp + ebx*4 + 0x1c]
jne 0x5a8da2
xor eax, eax
jmp 0x5a8dc2
mov esi, dword [0x7dc144]
push 0x396
movzx edi, ax
push 0x6cb488
push 0
add edi, edi
call fcn.00589980
mov esi, dword [esp + 0x30]
mov dword [ebp], eax
movzx eax, word [esp + ebx*4 + 0x1c]
mov word [ebp + 4], ax
add ebx, 1
add ebp, 0xc
cmp ebx, 4
jl 0x5a8d90
xor ebx, ebx
lea ebp, [esi + 0x30]
mov edi, edi
cmp dword [0x9d3e94], 0
movzx eax, word [esp + ebx*4 + 0x10]
jne 0x5a8df2
xor eax, eax
jmp 0x5a8e10
mov esi, dword [0x7dc144]
push 0x4c7
push str.m:development_segarally_sourcecodemaincodeSegaRally_ReplayControl.cpp
movzx edi, ax
push 0
call fcn.00589980
mov esi, dword [esp + 0x30]
mov dword [ebp], eax
movzx eax, word [esp + ebx*4 + 0x10]
mov word [ebp + 4], ax
add ebx, 1
add ebp, 0xc
cmp ebx, 3
jl 0x5a8de0
cmp byte [esp + 0x34], 0
je 0x5a8e6d
cmp dword [0x9d3e94], 0
jne 0x5a8e3b
xor eax, eax
jmp 0x5a8e58
mov esi, dword [0x7dc144]
push 0x7f
push 0x6cb2b0
push 0
mov edi, 0x1ec30
call fcn.00589980
mov esi, dword [esp + 0x30]
push 0x1ec30
push str.Replay_key_size__d_bytes_n
mov dword [esi + 0x54], eax
call fcn.00408d10
add esp, 8
or dword [esi + 0x60], 0x8000000
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x1c
ret 8
Function at 0x5b0c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
push str.CSR_PlayerProfile___Starting_Autosave_n
call fcn.00408d10
mov edi, dword [0x9549d8]
add esp, 4
push 0x954708
call fcn.005adef0
push 0
push 5
push 0x9555ac
mov dword [0xacde00], eax
call fcn.005bc7f0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.006663a0
test eax, eax
je 0x5b0c5c
mov edx, dword [esi + 8]
push 0x20
push eax
add edx, 0x7b0
push edx
call fcn.004a9696
add esp, 0xc
pop edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
jmp fcn.005b0220
Function at 0x5cb6e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
call fcn.005871e0
mov ebx, 1
xor ebp, ebp
test byte [0xb204bc], bl
jne 0x5cb725
or dword [0xb204bc], ebx
push 0x681210
mov dword [0xb204a8], ebp
mov dword [0xb204ac], ebp
mov dword [0xb204b0], ebp
mov dword [0xb204b8], ebp
call fcn.004a9213
add esp, 4
mov edx, dword [0xb204a8]
cmp edx, ebp
je 0x5cb755
mov ecx, dword [0xb204ac]
xor eax, eax
cmp ecx, ebp
je 0x5cb757
cmp edx, ebp
jbe 0x5cb755
add ecx, 0x80
cmp dword [ecx], ebp
je 0x5cb791
add eax, ebx
add ecx, 0x94
cmp eax, edx
jb 0x5cb745
mov eax, ebx
lea esi, [esp + 0x10]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ebp
call fcn.005c5cb0
lea ecx, [esp + 0xc]
push ecx
push ebp
push edi
push 0x5cb540
mov eax, esi
push 0x10000
push ebp
mov dword [edi + 0x24], eax
call fcn.004a9a93
add esp, 0x18
cmp eax, ebp
jne 0x5cb795
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x5cb7a4
xor eax, eax
jmp 0x5cb757
mov edx, dword [esp + 0xc]
mov dword [0x93d87c], eax
mov dword [0x93d878], edx
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
mov dword [edi + 0x10], ebx
mov eax, dword [edi + 0x10]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x5cb7d6
lea ecx, [ecx]
cmp dword [edi + 0x2c], ebp
jne 0x5cb7d6
push edi
call fcn.005c9680
push 0x14
call ebx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x5cb7c0
mov esi, 0x93d878
call fcn.00584820
cmp dword [edi + 0x18], ebp
mov dword [edi + 0x24], ebp
je 0x5cb7fb
push str.Loading_Abort_requested._Thread_will_block._n
call fcn.00408d10
add esp, 4
push 0x14
call ebx
jmp 0x5cb7f5
pop esi
mov dword [0x93d854], ebp
mov dword [0x93d858], ebp
mov dword [0x93d85c], ebp
mov dword [0x93d860], ebp
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5de7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c8
mov ecx, dword [esp + 0x1d0]
push ebx
push ebp
push esi
push edi
push 2
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 0x10]
xor ebp, ebp
mov dword [esp + 0x30], ebp
call fcn.004031c0
cmp dword [esp + 0x1e8], ebp
mov dword [esp + 0x14], ebp
jbe 0x5de95d
jmp 0x5de820
mov esi, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1ec]
mov eax, dword [esi + ebp*8]
lea edi, [eax + ecx]
mov edx, eax
mov eax, dword [esi + ebp*8 + 4]
lea esi, [eax + ecx]
sub eax, ecx
add eax, 1
sub edx, ecx
add edx, 1
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], eax
jae 0x5de949
mov eax, ecx
and eax, 0x3f
cmp edx, edi
mov ebx, edx
jae 0x5de93a
shl eax, 7
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1dc]
mov esi, ebx
and esi, 0x7f
add esi, dword [esp + 0x24]
imul esi, esi, 0x34
add esi, dword [eax + 0x80]
mov eax, dword [esp + 0x1e0]
cmp dword [esi + 0x30], eax
prefetcht2 byte [esi + 0x34]
jne 0x5de927
xor ebp, ebp
cmp dword [esi + 0x20], ebp
jbe 0x5de927
jmp 0x5de8b0
movzx edx, word [esi + ebp*2]
lea edi, [esp + 0x28]
call fcn.00403660
test eax, eax
je 0x5de913
mov ecx, dword [esp + 0x10c]
xor al, al
cmp dword [esp + 0x1f0], 0
jne 0x5de8f8
movzx edx, byte [esp + 0x1f4]
mov al, byte [ecx + 3]
mov edi, 0xff
sub edi, edx
movzx edx, al
cmp edi, edx
jle 0x5de8f6
add al, byte [esp + 0x1f4]
jmp 0x5de8f8
or al, 0xff
movzx eax, al
shl eax, 0x18
test byte [esp + 0x1d4], 2
je 0x5de913
mov dword [ecx], eax
mov ecx, dword [esp + 0x14c]
mov dword [ecx], eax
add ebp, 1
cmp ebp, dword [esi + 0x20]
jb 0x5de8b0
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
add ebx, 1
cmp ebx, edi
jb 0x5de877
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
add ecx, 1
cmp ecx, esi
mov dword [esp + 0x10], ecx
jb 0x5de861
add ebp, 1
cmp ebp, dword [esp + 0x1e8]
mov dword [esp + 0x14], ebp
jb 0x5de820
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5de98d
test byte [esp + 0x1d4], 2
je 0x5de98d
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 0x18]
mov eax, dword [eax]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x30]
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c8
ret 0x1c
Function at 0x5f0c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0xb8], eax
call fcn.005f07fd
or byte cs:[ecx + 0x39], bh
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.005f07fd
push edi
fld qword [esi + ecx - 0x837a73]
invalid
Function at 0x6264b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push ebp
mov ebx, 1
test byte [0xb314e4], bl
push esi
push edi
jne 0x6264e2
or dword [0xb314e4], ebx
call fcn.0053ed20
push 0x681e20
call fcn.004a9213
add esp, 4
xor ebp, ebp
xor edx, edx
mov eax, 0xb2f468
lea ecx, [ebp + 4]
mov edi, edi
cmp dword [eax], ebp
je 0x6264f6
add edx, ebx
add eax, 0x1c0
sub ecx, ebx
jne 0x6264f0
cmp edx, ebp
jne 0x6265b9
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], 0x12
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [ecx + 0xc], eax
shr eax, 0x10
and eax, 0x7fff
mov edx, eax
mov eax, dword [ecx + 0xc]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [ecx + 0xc], eax
shr eax, 0x10
and eax, 0x7fff
shl edx, 0x10
add eax, edx
cdq
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x9423b0]
xor ecx, ecx
cmp edx, eax
jne 0x626598
mov eax, dword [0x9423b4]
cmp eax, ecx
je 0x6265a5
push str.NETWORK_ML:_WARNING:Network_Function_Call_from_wrong_thread__n
call fcn.00408d10
add esp, 4
push ebp
push edi
push esi
lea ecx, [esp + 0x20]
push ecx
xor eax, eax
mov ecx, 0xb2f430
call fcn.00540f70
test byte [0xb37480], bl
jne 0x6265f2
or dword [0xb37480], ebx
push 0x681670
mov dword [0xb37320], ebp
mov dword [0xb3732c], ebp
mov dword [0xb37330], ebp
mov dword [0xb37334], ebp
mov dword [0xb37338], ebp
call fcn.004a9213
add esp, 4
mov edi, 0x955050
mov dword [0xb3734c], ebx
mov dword [0x9549f4], 8
call fcn.00592f40
push ebp
mov dword [0x954f28], 3
mov dword [0x9540b0], ebx
call fcn.005935c0
add esp, 4
call fcn.0061dbd0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x633410
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x633416
sub eax, esi
mov ecx, eax
test ecx, ecx
mov eax, 0x4e67c6a7
jle 0x63344c
push edi
lea ecx, [ecx]
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 2
add esi, edi
movsx edi, byte [edx]
add esi, edi
xor eax, esi
add edx, 1
sub ecx, 1
jne 0x633430
pop edi
and eax, 0x7fffffff
pop esi
ret
Function at 0x640bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [edi + 0x328]
sub esp, 0xe0
push ebx
push esi
xor esi, esi
cmp eax, esi
je 0x640da5
mov ebx, dword [eax + 0xc]
cmp ebx, esi
je 0x640da5
xorps xmm0, xmm0
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], 0xffffffff
movss dword [esp + 0x10], xmm0
call fcn.00405050
test ebx, ebx
mov eax, dword [0x6c73e8]
mov ecx, dword [0x6c73ec]
mov edx, dword [0x6c73f0]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
jle 0x640da5
lea esp, [esp]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [edi + 0x328]
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x6c]
push eax
push esi
call fcn.0044a6b0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x640c8a
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
cmp eax, 1
jne 0x640c8a
mov ecx, dword [esp + 0x18]
jmp 0x640ca6
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x640d1c
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
cmp eax, 1
jne 0x640d1c
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x640d1c
fld dword [esp + 0xd8]
fabs
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp dword [esp + 0xc]
fld dword [esp + 0x10]
fld dword [esp + 0xc]
fcompi st(1)
fstp st(0)
jbe 0x640d1c
mov edx, dword [ecx]
movss xmm0, dword [esp + 0xc]
mov eax, dword [edx + 0x30]
mov dword [esp + 0x14], esi
movss dword [esp + 0x10], xmm0
call eax
fld dword [eax]
fld qword [0x6faa20]
fmul st(1), st(0)
fxch st(1)
fstp dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
fld dword [eax + 4]
fmul st(1)
fstp dword [esp + 0x24]
mov edx, dword [esp + 0x24]
fmul dword [eax + 8]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
fstp dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
add esi, 1
cmp esi, ebx
jl 0x640c50
cmp dword [esp + 0x14], 0xffffffff
je 0x640da5
test byte [edi + 0x1a4], 8
je 0x640d48
mov esi, edi
mov dword [edi + 0x1ac], 1
call fcn.0064c160
lea ecx, [esp + 0x34]
push ecx
lea esi, [edi + 0x528]
call fcn.006407e0
mov esi, dword [edi + 0x55c]
test esi, esi
je 0x640d75
fld dword [edi + 0x554]
push ecx
lea edx, [edi + 0x78]
fstp dword [esp]
push edx
call fcn.00640440
fld dword [esp + 0x10]
push ecx
fstp dword [esp]
push edi
call fcn.0064f040
mov esi, dword [edi + 0x328]
test esi, esi
je 0x640da5
call fcn.00404c70
mov ecx, dword [eax + 4]
push esi
call fcn.00455480
mov dword [edi + 0x328], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x654320
Capabilities:
Encode data using xor

Disassembly:
call fcn.005da1f0
mov ecx, 0x725550
mov dword [eax], 0
call fcn.006531b0
xor edx, edx
test eax, eax
jbe 0x654361
mov ecx, 0x9555c8
push esi
mov esi, eax
sub esi, edx
lea esi, [esi*4 - 4]
xor esi, dword [ecx]
add edx, 1
and esi, 0x3c
xor dword [ecx], esi
add ecx, 0xec8
cmp edx, eax
jb 0x654341
pop esi
mov eax, 0xc
ret
Function at 0x654b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 8], eax
mov edx, dword [eax]
sub edx, 1
cmp dword [0x9d3e94], 0
push esi
push edi
mov dword [esp + 0xc], edx
jne 0x654ba8
xor eax, eax
jmp 0x654bca
mov esi, dword [0x783c50]
push 0x17f
lea edi, [edx + edx*2]
push 0x6e6f88
add edi, edi
push 0
add edi, edi
call fcn.00589980
mov edx, dword [esp + 0xc]
test edx, edx
xorps xmm1, xmm1
mov ecx, 9
mov esi, 0x6c7428
lea edi, [esp + 0x24]
mov dword [ebx], eax
rep movsd dword es:[edi], dword [esi]
movss xmm0, dword [esp + 0x24]
movss dword [esp + 0x48], xmm0
movss xmm0, dword [esp + 0x28]
movss dword [esp + 0x4c], xmm0
movss xmm0, dword [esp + 0x2c]
movss dword [esp + 0x50], xmm0
movss xmm0, dword [esp + 0x30]
movss dword [esp + 0x58], xmm0
movss xmm0, dword [esp + 0x34]
movss dword [esp + 0x5c], xmm0
movss xmm0, dword [esp + 0x38]
movss dword [esp + 0x60], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [esp + 0x68], xmm0
movss xmm0, dword [esp + 0x40]
movss dword [esp + 0x6c], xmm0
movss xmm0, dword [esp + 0x44]
movss dword [esp + 0x70], xmm0
movss xmm0, dword [0x6cc5ec]
movss dword [esp + 0x54], xmm1
movss dword [esp + 0x64], xmm1
movss dword [esp + 0x74], xmm1
movss dword [esp + 0x78], xmm1
movss dword [esp + 0x7c], xmm1
movss dword [esp + 0x80], xmm1
movss dword [esp + 0x84], xmm0
jbe 0x654cbd
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], edx
nop
mov ecx, dword [ebx]
mov eax, dword [ebx + 8]
mov edx, dword [eax + 4]
add ecx, edi
push ecx
add edx, esi
lea ecx, [esp + 0x4c]
call fcn.00404e50
add esp, 4
add esi, 0x10
add edi, 0xc
sub dword [esp + 0x10], 1
jne 0x654c90
xorps xmm1, xmm1
mov edx, dword [esp + 0xc]
cmp dword [0x9d3e94], 0
jne 0x654cca
xor eax, eax
jmp 0x654cee
mov esi, dword [0x783c50]
push 0x1a3
push 0x6e6fd0
lea edi, [edx + edx*2]
push 0
shl edi, 4
call fcn.00589980
xorps xmm1, xmm1
mov edx, dword [esp + 0xc]
xor esi, esi
cmp edx, esi
mov dword [ebx + 4], eax
mov dword [esp + 0x10], esi
jle 0x654d90
xor edi, edi
jmp 0x654d14
mov edx, dword [esp + 0xc]
xor edi, edi
jmp 0x654d14
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edi
push ebx
mov eax, edx
call fcn.00649f50
mov edx, dword [ebx + 4]
movss xmm0, dword [esp + 0x14]
movss dword [esi + edx], xmm0
mov eax, dword [ebx + 4]
movss xmm0, dword [esp + 0x18]
movss dword [esi + eax + 4], xmm0
mov ecx, dword [ebx + 4]
movss xmm0, dword [esp + 0x1c]
movss dword [esi + ecx + 8], xmm0
mov edx, dword [ebx + 4]
movss xmm0, dword [esp + 0x20]
movss dword [esi + edx + 0xc], xmm0
add edi, 1
add esi, 0x10
cmp edi, 2
jle 0x654d10
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
jl 0x654d03
push ebx
movss dword [ebx + 0xc], xmm1
call fcn.00654a80
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6552d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push edi
call fcn.006663a0
test eax, eax
je 0x6552ec
push 0x20
push eax
push 0x954eb8
call fcn.004a9696
add esp, 0xc
push 0x20
push 0x6ecc00
push 0x955d80
call fcn.004a9696
add esp, 0xc
cmp word [0x954eb8], 0
mov ebx, 1
jne 0x655357
test byte [0xb313ec], bl
jne 0x65532f
or dword [0xb313ec], ebx
call fcn.005bf670
push 0x6815e0
call fcn.004a9213
add esp, 4
mov eax, dword [0xb2f06c]
mov edx, dword [eax + 0x10]
push str.LANG_ID_PLAYER_1_NUMBER_LABEL
mov ecx, 0xb2f06c
call edx
test eax, eax
je 0x655357
push 0x20
push eax
push 0x954eb8
call fcn.004a9696
add esp, 0xc
cmp word [0x955d80], 0
jne 0x6553a9
test byte [0xb313ec], bl
jne 0x655381
or dword [0xb313ec], ebx
call fcn.005bf670
push 0x6815e0
call fcn.004a9213
add esp, 4
mov eax, dword [0xb2f06c]
mov edx, dword [eax + 0x10]
push str.LANG_ID_PLAYER_2_NUMBER_LABEL
mov ecx, 0xb2f06c
call edx
test eax, eax
je 0x6553a9
push 0x20
push eax
push 0x955d80
call fcn.004a9696
add esp, 0xc
push 0x954eb8
push 0
push 0
mov eax, 0x9540a8
call fcn.005affe0
push 0x955d80
push 0
push ebx
mov eax, 0x9540a8
call fcn.005affe0
mov edi, dword [0x9549e8]
push 0x9558a0
call fcn.005ae130
mov edx, dword [0x9540a8]
xor ecx, ecx
test edx, edx
jbe 0x655417
mov eax, 0x9555c8
nop
mov edi, edx
sub edi, ecx
lea edi, [edi*4 - 4]
xor edi, dword [eax]
mov dword [eax - 0x6d0], 0
and edi, 0x3c
xor dword [eax], edi
add ecx, ebx
add eax, 0xec8
cmp ecx, edx
jb 0x6553f0
test byte [0xb2f0b4], bl
jne 0x65542a
or dword [0xb2f0b4], ebx
call fcn.005ada90
pop edi
mov dword [0x954550], ebx
mov dword [0xb2dda8], 0
mov eax, 0xc
pop ebx
pop ecx
ret
Function at 0x655bdc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, eax
mov eax, dword [0x9cd890]
mov dword [esi + 8], eax
cmp dword [0x954130], 0
push edi
je 0x655bd5
mov eax, dword [0x93d2f0]
test eax, eax
je 0x655bd5
test byte [eax + 0x474], 1
je 0x655bd5
mov edi, 0x9549d8
call fcn.005ae2b0
mov ecx, dword [0x9549f0]
push ecx
push 0xc
push 0x9555ac
call fcn.005bc7f0
mov ecx, esi
call fcn.006531b0
movzx ecx, byte [0x9554b2]
mov ebx, eax
mov eax, dword [0x9554b0]
mov edx, eax
shr edx, 0x15
and edx, 0x1f
shr eax, 0xb
add edx, 1
push edx
and ecx, 0x1f
add ecx, 1
and eax, 0x1f
push ecx
add eax, 1
push eax
push str.Replay_AI_is_level:__d__d__d__n
call fcn.00408d10
mov esi, dword [0x9554b0]
shr esi, 0xb
add esp, 0x10
and esi, 0x1f
call fcn.005da1f0
cmp esi, 0x13
ja 0x655c42
mov dword [eax + 8], esi
jmp 0x655c49
mov dword [eax + 8], 9
mov ecx, dword [eax + 8]
push ecx
cvtsi2ss xmm0, ecx
push 0x6d5cf8
movss dword [eax + 0x10], xmm0
movss dword [eax + 0xc], xmm0
call fcn.00408d10
movzx edx, byte [0x9554b2]
and edx, 0x1f
add esp, 4
cvtsi2ss xmm0, edx
movss dword [esp], xmm0
call fcn.005da1f0
push eax
call fcn.005e13f0
mov eax, dword [0x9554b0]
shr eax, 0x15
and eax, 0x1f
test eax, eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jge 0x655ca3
fadd dword [0x6f9a18]
push ecx
fstp dword [esp]
call fcn.005da1f0
push eax
call fcn.005e1370
call fcn.005da1f0
xor esi, esi
test ebx, ebx
mov dword [eax], 0
jbe 0x655cf6
mov edi, 0x9555c8
push 0
push 0
push esi
mov eax, 0x9540a8
call fcn.005affe0
mov ecx, ebx
sub ecx, esi
lea edx, [ecx*4 - 4]
xor edx, dword [edi]
add esi, 1
and edx, 0x3c
xor dword [edi], edx
add edi, 0xec8
cmp esi, ebx
jb 0x655cc8
pop edi
pop esi
mov eax, 0xc
pop ebx
add esp, 8
ret