joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4572c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x489c04]
cmp dword [eax + 0x30], 0
je 0x45736a
cmp dword [ebx + 0x94], 0
jne 0x457364
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x457250
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x457364
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45732a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x457364
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414698
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x457339
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457e48
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x457e7d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040436c
jmp 0x457e8a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042d0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x458e98
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x458ed9
mov eax, esi
call fcn.0043eed8
test al, al
je 0x458ed9
mov eax, dword [ebx + 0x84]
call fcn.0043ebd4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x458ed9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043ebd4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4598d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0x7fff
jg 0x4599f4
mov eax, dword [ebp - 4]
cmp byte [eax], 0x51
jne 0x4599f4
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x44
jne 0x4599f4
mov eax, dword [ebp - 4]
add eax, 6
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
sub eax, 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 7
jle 0x4599ed
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x1c]
inc eax
mov ax, word [eax]
mov word [ebp - 0x20], ax
mov ax, word [ebp - 0x20]
call fcn.00407150
xor al, byte [ebp - 0x20]
mov byte [ebp - 0x1e], al
add dword [ebp - 0x1c], 3
sub dword [ebp - 0x18], 3
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x45996c
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
xor al, byte [ebp - 0x1e]
not al
mov edx, dword [ebp - 0x1c]
mov byte [edx], al
inc dword [ebp - 0x1c]
dec dword [ebp - 0x18]
inc dword [ebp - 0x10]
movzx eax, word [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jg 0x459954
cmp byte [ebp - 0x1d], 7
ja 0x4599ed
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
add dword [ebp - 0x1c], 4
sub dword [ebp - 0x18], 4
cmp byte [ebp - 0x1d], 6
je 0x45999f
cmp byte [ebp - 0x1d], 7
je 0x45999f
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
jmp 0x4599e3
mov ax, word [ebp - 0x14]
mov word [ebp - 0x20], ax
mov ax, word [ebp - 0x20]
call fcn.00407150
xor al, byte [ebp - 0x20]
mov byte [ebp - 0x1e], al
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jge 0x4599e3
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
xor al, byte [ebp - 0x1e]
not al
mov edx, dword [ebp - 0x1c]
mov byte [edx], al
inc dword [ebp - 0x1c]
dec dword [ebp - 0x18]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jl 0x4599c3
cmp dword [ebp - 0x18], 7
jg 0x459923
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x45c68c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0045c1d0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040472c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45c6ea
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x488a80]
mov dl, 1
mov eax, dword [0x45c0c8]
call fcn.0040a79c
call fcn.00403cdc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45c6f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040472c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45c74c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x488c84]
mov dl, 1
mov eax, dword [0x45c0c8]
call fcn.0040a79c
call fcn.00403cdc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045c200
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x462c98
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x462d70
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x489cdc], 0
jne 0x462d54
lea eax, [ebp - 4]
mov edx, 0x462d88
call fcn.00404314
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040472c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x462d54
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x462d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x462d37
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x462d98
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x462d37
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x489cdc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462d54
mov eax, dword [ebp - 0xc]
call fcn.0040274c
ret
mov ebx, dword [0x489cdc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462d77
lea eax, [ebp - 4]
call fcn.0040427c
ret
Function at 0x46f718
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x160]
mov edx, dword [0x40766c]
call fcn.00404c58
xor eax, eax
push ebp
push 0x46f8ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x488aac]
mov eax, dword [eax]
call fcn.0040472c
push eax
call sub.Shlwapi.dll_PathIsDirectoryA
test eax, eax
je 0x46f897
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd4]
mov edx, dword [0x488aac]
mov edx, dword [edx]
lea eax, [ebp - 0x164]
mov ecx, 0x46f8e4
call fcn.00404580
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x10
call fcn.004089fc
test eax, eax
jne 0x46f86c
mov eax, dword [ebp - 0x158]
and eax, 0x10
cmp eax, dword [ebp - 0x158]
jne 0x46f84e
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x154]
call fcn.00404314
mov eax, dword [ebp - 8]
mov edx, 0x46f8f0
call fcn.00404678
je 0x46f84e
mov eax, dword [ebp - 8]
mov edx, 0x46f8fc
call fcn.00404678
je 0x46f84e
mov eax, dword [0x488aac]
push dword [eax]
push dword [ebp - 8]
push 0x46f908
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004045f4
mov eax, dword [ebp - 0x168]
call fcn.0040472c
push eax
call sub.Shlwapi.dll_PathFileExistsA
test eax, eax
je 0x46f84e
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x284]
xor ecx, ecx
mov edx, dword [ebp - 0x154]
call fcn.0046d70c
lea eax, [ebp - 0x160]
call fcn.00408a4c
test eax, eax
je 0x46f7b5
lea eax, [ebp - 0x160]
call fcn.00408a70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x284]
call fcn.004156ac
test eax, eax
jle 0x46f897
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f8d5
lea eax, [ebp - 0x168]
mov edx, 2
call fcn.004042a0
lea eax, [ebp - 0x160]
mov edx, dword [0x40766c]
call fcn.00404d28
lea eax, [ebp - 8]
call fcn.0040427c
ret
Function at 0x47342c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x47345a
mov eax, ebx
call fcn.00473ee4
cmp dword [ebx + 0x3c], 0
je 0x473453
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4734cb
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4734bd
cmp dword [ebx + 8], 0
je 0x47347c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x47348e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4734bd
cmp dword [ebx + 8], 0
je 0x47346f
cmp eax, 3
je 0x4734a1
dec eax
jne 0x47346f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47346f
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x47346f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4734e9
cmp dword [ebx + 0x10], 0xcc
je 0x4734e9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004734f4
pop ebx
ret
Function at 0x484d68
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffad0
xor edx, edx
mov dword [ebp - 0x530], edx
mov dword [ebp - 0x52c], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x528], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x484fcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x488aac]
push dword [eax]
mov eax, dword [0x488bf4]
push dword [eax]
push 0x484fe0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004045f4
mov eax, dword [ebp - 0x14]
call fcn.00459a94
test al, al
je 0x484de3
mov eax, dword [ebp - 0x14]
call fcn.0040472c
push eax
call sub.Shlwapi.dll_PathFileExistsA
test eax, eax
jne 0x484e00
push 0x40
mov ecx, 0x484fec
mov edx, 0x484ff4
mov eax, dword [0x488af8]
mov eax, dword [eax]
call fcn.00458408
jmp 0x484f7d
call fcn.00484b94
test eax, eax
jne 0x484e26
push 0x40
mov ecx, 0x484fec
mov edx, 0x485020
mov eax, dword [0x488af8]
mov eax, dword [eax]
call fcn.00458408
jmp 0x484f7d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x26c]
call fcn.00464228
mov dword [ebp - 0xc], 0x12
lea edx, [ebp - 0x124]
mov ecx, 0x7f
mov eax, dword [ebp - 0x14]
call fcn.004050a4
lea eax, [ebp - 0x10]
call fcn.00405ff0
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x124]
push eax
call sub.ole32.dll_StgOpenStorage
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x484e99
push 0x40
mov ecx, 0x484fec
mov edx, 0x485038
mov eax, dword [0x488af8]
mov eax, dword [eax]
call fcn.00458408
jmp 0x484f7d
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00408b0c
mov eax, dword [ebp - 0x18]
call fcn.00404534
mov edx, eax
dec edx
lea ecx, [ebp - 0x52c]
mov eax, dword [ebp - 0x18]
call fcn.00431fbc
mov edx, dword [ebp - 0x52c]
lea eax, [ebp - 0x18]
call fcn.00404314
lea edx, [ebp - 0x530]
mov eax, dword [ebp - 0x18]
call fcn.00408b40
mov edx, dword [ebp - 0x530]
lea eax, [ebp - 0x18]
call fcn.00404314
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x26c]
mov ecx, dword [ebp - 0x18]
xor edx, edx
call fcn.004642bc
mov edx, dword [ebp - 0x10]
call fcn.00484944
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x26c]
call fcn.004641f0
test eax, eax
jle 0x484f7d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.004645a4
mov dl, 1
call fcn.0046354c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.004645a4
mov edx, 5
call fcn.00463220
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.004645a4
mov edx, 5
call fcn.00463278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484fd2
lea eax, [ebp - 0x530]
mov edx, 2
call fcn.004042a0
lea eax, [ebp - 0x528]
call fcn.0040496c
lea eax, [ebp - 0x24]
call fcn.00405ff0
lea eax, [ebp - 0x20]
call fcn.00405ff0
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004042a0
lea eax, [ebp - 0x10]
call fcn.00405ff0
ret
Function at 0x4075de
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461944], 0
jne 0x407619
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4075f2
mov dword [ecx*4 + 0x461940], eax
inc ecx
cmp ecx, 0x100
jl 0x4075ed
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407646
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461940]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x407627
not eax
pop ebp
ret 0xc

Function at 0x40a940
Capabilities:
Encode data using xor

Disassembly:
push ebp
lodsb al, byte [esi]
lcall 0xcf9, 0x5608458b
test dword [edi], esp
jg 0x40a98e
add byte [ebp + 0x55a8534], cl
inc ecx
add byte [ebp + 0x6b1775c9], al
call 0x41059de4
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_LoadLibraryA
test eax, eax
sub dword [esi], eax
jne 0x40a970
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40a984
mov ecx, dword [esi]
sahf
push ecx
pop eax
adc eax, 0xc940c01c
pop esi
pop ebp
ret
mov esp, dword [ebx + 0x52068b0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
rol byte [eax], 0x5e
mov bl, 0xc3
nop
das
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
cmp eax, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [eax*4 - 0x7aa762e]
jne 0x40a9c3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x6510
invalid
Function at 0x639c1a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x639c1aab
cmp byte [esi + ebx - 1], 0xa
je 0x639c1a7f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x639c70a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x10017b80
Capabilities:
Hash data using djb2

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x100e9e9c]
xor esi, esi
mov dword [esp + 0x10], edx
mov ebp, ecx
mov eax, 0x100ea8b0
test edi, edi
je 0x10017baf
nop dword [eax]
cmp byte [eax], 0
je 0x10017baf
inc esi
add eax, 0x140
cmp esi, edi
jb 0x10017ba0
cmp esi, edi
jne 0x10017bd6
cmp edi, 0x2000
jne 0x10017bcf
push str.GL_AllocTexture:_MAX_TEXTURES_limit_exceeds_n
call dword [0x11a5f3dc]
mov edi, dword [0x100e9e9c]
add esp, 4
inc edi
mov dword [0x100e9e9c], edi
lea eax, [esi + esi*4]
shl eax, 6
lea ebx, [eax + 0x100ea8b0]
test ebx, ebx
je 0x10017c23
test ebp, ebp
je 0x10017c23
mov ecx, ebp
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017bf0
sub ecx, edx
inc ecx
cmp ecx, 0x100
jbe 0x10017c18
mov ecx, 0x3f
mov esi, ebp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 0xff], al
jmp 0x10017c23
push ecx
push ebp
push ebx
call fcn.10051eb0
add esp, 0xc
mov edi, dword [esp + 0x10]
test edi, 0x400
je 0x10017c4b
cmp dword [0x11a22f80], 3
je 0x10017c4b
mov eax, dword [0x11a097a4]
mov dword [ebx + 0x110], eax
inc eax
mov dword [0x11a097a4], eax
jmp 0x10017c6a
lea esi, [ebx + 0x110]
push esi
push 1
call dword [0x11a5f0c4]
mov eax, dword [esi]
cmp eax, 0x16a8
jb 0x10017c6a
cmp eax, 0x16ae
jbe 0x10017c51
mov dword [ebx + 0x11c], edi
mov esi, 0x1505
mov ah, byte [ebp]
test ah, ah
je 0x10017cae
nop dword [eax]
mov dl, ah
lea ebp, [ebp + 1]
mov al, ah
sub dl, 0x41
add al, 0x20
cmp dl, 0x19
movzx ecx, al
movzx eax, ah
cmova ecx, eax
mov eax, esi
shl eax, 5
and ecx, 0xdf
add esi, eax
mov ah, byte [ebp]
add esi, ecx
test ah, ah
jne 0x10017c80
and esi, 0x7ff
mov eax, ebx
pop edi
mov dword [ebx + 0x138], esi
mov ecx, dword [esi*4 + 0x1036a8b0]
mov dword [esi*4 + 0x1036a8b0], ebx
pop esi
pop ebp
mov dword [ebx + 0x13c], ecx
pop ebx
pop ecx
ret
Function at 0x10019d00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x100b6004]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
push 0x27fff7
push 0
push 0x100ea8b9
call fcn.1004a480
push 0x2000
push 0
push 0x1036a8b0
call fcn.1004a480
mov al, byte [0x100a779c]
mov ecx, 0x100ea8b0
movq xmm0, qword [str.unused]
movq qword [0x100ea8b0], xmm0
mov byte [0x100ea8b8], al
call fcn.100486d0
mov dword [0x100ea9e8], eax
mov dword [0x100e9e9c], 1
mov ecx, dword [eax*4 + 0x1036a8b0]
mov dword [0x100ea9ec], ecx
mov dword [eax*4 + 0x1036a8b0], 0x100ea8b0
call fcn.10015210
call fcn.10018e50
push 0x10000
xorps xmm0, xmm0
mov dword [esp + 0x4c], 0
movaps xmmword [esp + 0x2c], xmm0
mov eax, 1
movaps xmmword [esp + 0x3c], xmm0
push 0
push 0x115f7c1c
mov dword [esp + 0x34], 0x800080
mov word [esp + 0x38], ax
mov dword [esp + 0x40], 4
mov dword [esp + 0x4c], 0x115f7c1c
mov dword [esp + 0x3c], 3
mov dword [esp + 0x54], 0x10000
mov byte [esp + 0x46], al
call fcn.1004a480
add esp, 0x24
mov edi, str.rippletex
mov esi, 0x1505
mov ah, 0x2a
mov dl, ah
lea edi, [edi + 1]
mov al, ah
sub dl, 0x41
add al, 0x20
cmp dl, 0x19
movzx ecx, al
movzx eax, ah
cmova ecx, eax
mov eax, esi
shl eax, 5
and ecx, 0xdf
add esi, eax
mov ah, byte [edi]
add esi, ecx
test ah, ah
jne 0x10019df8
and esi, 0x7ff
mov esi, dword [esi*4 + 0x1036a8b0]
test esi, esi
je 0x10019e5c
nop word [eax + eax]
push str.rippletex
push esi
call fcn.100746f7
add esp, 8
test eax, eax
je 0x10019ea1
mov esi, dword [esi + 0x13c]
test esi, esi
jne 0x10019e40
mov edx, 0x40001000
mov ecx, str.rippletex
call fcn.10017b80
mov esi, eax
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.10017970
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.100171a0
test eax, eax
jne 0x10019e9a
push 0x140
push eax
push esi
call fcn.1004a480
add esp, 0xc
xor eax, eax
jmp 0x10019eb8
mov ecx, esi
call fcn.10014d00
sub esi, 0x100ea8b0
mov eax, 0x66666667
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
push str.display_loaded_textures_list
push 0x100196f0
push str.texturelist
mov dword [0x11607c20], eax
call dword [0x11a5f344]
mov ecx, dword [esp + 0x58]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.10048715
mov esp, ebp
pop ebp
ret
Function at 0x10033df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [0x11607ea4]
movaps xmm5, xmm0
push ebx
push ebp
push esi
mov ebp, dword [eax + 0x94]
mov esi, edx
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
mov ecx, dword [eax + 0x98]
xor ebx, ebx
add ecx, 8
mov dword [esp + 0x14], edi
xorps xmm4, xmm4
xorps xmm1, xmm1
test ebp, ebp
jle 0x10033fc0
movss xmm6, dword [0x100aa6b0]
add ecx, eax
movss xmm3, dword [0x100aa724]
movss xmm7, dword [0x100aa758]
mov edx, dword [ecx + 0xc]
cmp edx, 4
jne 0x10033e87
movzx eax, byte [esp + 0x20]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm6
comiss xmm0, xmm4
jb 0x10033e6b
comiss xmm3, xmm0
ja 0x10033e6e
movaps xmm0, xmm3
jmp 0x10033e6e
movaps xmm0, xmm4
movaps xmm1, xmm3
subss xmm1, xmm0
mulss xmm0, dword [ecx + 4]
mulss xmm1, dword [ecx]
addss xmm1, xmm0
jmp 0x10033f79
jge 0x10033f79
test dword [ecx - 4], 0x8000
movaps xmm0, xmm3
mov eax, dword [esp + 0x1c]
subss xmm0, xmm5
je 0x10033f29
movzx edi, byte [edx + eax]
movzx esi, byte [edx + esi]
mov eax, esi
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x80
jle 0x10033efd
lea eax, [edi - 0x80]
mov edi, dword [esp + 0x14]
movzx eax, al
movd xmm1, eax
lea eax, [esi - 0x80]
cvtdq2ps xmm1, xmm1
movzx eax, al
mov esi, dword [esp + 0x10]
mulss xmm1, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm5
addss xmm1, xmm0
subss xmm1, dword [0x100aa918]
mulss xmm1, xmm7
addss xmm1, dword [ecx]
jmp 0x10033f79
movd xmm1, edi
cvtdq2ps xmm1, xmm1
mov edi, dword [esp + 0x14]
mulss xmm1, xmm0
movd xmm0, esi
mov esi, dword [esp + 0x10]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm5
addss xmm1, xmm0
mulss xmm1, xmm7
addss xmm1, dword [ecx]
jmp 0x10033f79
movzx eax, byte [edx + eax]
movd xmm2, eax
movzx eax, byte [edx + esi]
cvtdq2ps xmm2, xmm2
mulss xmm2, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm5
addss xmm2, xmm0
divss xmm2, dword [0x100aa924]
comiss xmm2, xmm4
jb 0x10033f62
comiss xmm3, xmm2
ja 0x10033f65
movaps xmm2, xmm3
jmp 0x10033f65
movaps xmm2, xmm4
movaps xmm1, xmm3
subss xmm1, xmm2
mulss xmm2, dword [ecx + 4]
mulss xmm1, dword [ecx]
addss xmm1, xmm2
mov eax, dword [ecx - 4]
and eax, 0x7fff
dec eax
cmp eax, 0x1f
ja case.0x10033f8e.3
movzx eax, byte [eax + 0x10033fd4]
jmp dword [eax*4 + 0x10033fc8]
xorps xmm0, xmm0
cvtss2sd xmm0, xmm1
mulsd xmm0, qword [0x100aa738]
cvtpd2ps xmm0, xmm0
movss dword [edi + ebx*4], xmm0
jmp case.0x10033f8e.3
movss dword [edi + ebx*4], xmm1
inc ebx
add ecx, 0x18
cmp ebx, ebp
jl 0x10033e44
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret