joyce8/EMBER2024-capa huggingface dataset:
Function at 0x544ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x64
fld dword [0xd424d0]
mov eax, dword [0xd47044]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x88]
mov ebx, dword [esp + 0x80]
mov edx, dword [edx]
mov ecx, dword [ecx]
mov eax, dword [eax]
fstp qword [esp + 0x44]
fld dword [0xd424d4]
fstp qword [esp + 0x3c]
fld1
fstp qword [esp + 0x34]
movzx esi, word [eax + edx*4 + 0xeea]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], ecx
mov ecx, 8
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], 9
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
movzx eax, word [eax + edx*4 + 0xee8]
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x74]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x84]
fld dword [0xd424d8]
mov eax, dword [eax]
mov dword [esp], 5
mov dword [esp + 0xc], eax
mov eax, 3
fstp qword [esp + 4]
call fcn.005a3b10
mov dword [ebx], eax
mov eax, dword [esp + 0x5c]
sub eax, dword [0xd47044]
jne 0x544f6f
add esp, 0x64
pop ebx
pop esi
ret
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x5452e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ecx, ecx
sub esp, 0x68
fld dword [0xd424dc]
mov eax, dword [0xd47044]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x88]
mov eax, dword [eax]
fst qword [esp + 0x44]
fldz
fst qword [esp + 0x3c]
fstp qword [esp + 0x34]
movzx edx, word [eax + 0xf32]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x78]
mov edx, dword [edx]
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x74]
mov edx, dword [edx]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x24], edx
movzx eax, word [eax + 0xf30]
mov edx, 3
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x7c]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x8c]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, 6
fstp qword [esp + 4]
mov dword [esp], 3
call fcn.005a3b10
mov dword [ebx], eax
mov eax, dword [esp + 0x5c]
sub eax, dword [0xd47044]
jne 0x54539f
add esp, 0x68
pop ebx
ret
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x5937d0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0xd47044]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
not eax
cmp esi, 3
jbe 0x5938b0
lea edx, [esi - 4]
shr edx, 2
lea ebx, [ecx + edx*4 + 4]
nop
mov edx, eax
xor al, byte [ecx]
add ecx, 4
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa8f0a0]
mov eax, edx
xor dl, byte [ecx - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa8f0a0]
mov edx, eax
xor al, byte [ecx - 2]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa8f0a0]
mov eax, edx
xor dl, byte [ecx - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa8f0a0]
cmp ecx, ebx
jne 0x593800
and esi, 3
test esi, esi
je 0x593896
mov edx, eax
xor al, byte [ebx]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa8f0a0]
mov eax, edx
cmp esi, 1
je 0x593896
xor al, byte [ebx + 1]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa8f0a0]
mov eax, edx
cmp esi, 2
je 0x593896
xor al, byte [ebx + 2]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa8f0a0]
mov eax, edx
not eax
mov edx, dword [esp + 0xc]
sub edx, dword [0xd47044]
jne 0x5938b4
add esp, 0x14
pop ebx
pop esi
ret
mov ebx, ecx
jmp 0x593851
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
Function at 0x5b2ca0
Capabilities:
Create directory

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x22c
movzx ebx, byte [esi]
mov eax, dword [0xd47044]
mov dword [esp + 0x21c], eax
xor eax, eax
lea ebp, [esp + 0x1b]
cmp bl, 0x40
jg 0x5b2d70
lea edi, [esp + 0x1c]
mov ecx, ebp
xor eax, eax
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
sub ecx, edi
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
test bl, bl
je 0x5b2d50
xor edi, edi
jmp 0x5b2d2c
cmp bl, 0x5c
je 0x5b2d31
mov dword [esp], edi
add esi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov byte [esp + eax + 0x1a], bl
mov edi, eax
movzx ebx, byte [esi]
cmp eax, 0x200
je 0x5b2d50
test bl, bl
je 0x5b2d50
cmp bl, 0x2f
jne 0x5b2d00
test edi, edi
je 0x5b2d05
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5b2e70
movzx ebx, byte [esi]
jmp 0x5b2d05
xor eax, eax
mov edx, dword [esp + 0x21c]
sub edx, dword [0xd47044]
jne 0x5b2e9d
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp bl, 0x5a
jg 0x5b2db0
cmp byte [esi + 1], 0x3a
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
je 0x5b2dd8
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x5b2cf6
lea eax, [ebx - 0x61]
cmp al, 0x19
jbe 0x5b2d75
mov dword [esp + 0x1b], 0
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x218], 0
jmp 0x5b2d94
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
lea edi, [esi + 2]
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0x3a
movzx esi, byte [esi + 2]
mov eax, esi
test al, al
je 0x5b2d50
mov ebx, 2
jmp 0x5b2e48
cmp al, 0x5c
je 0x5b2e4e
mov dword [esp], ebx
add edi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov ebx, eax
mov eax, esi
movzx esi, byte [edi]
mov byte [esp + ebx + 0x1a], al
mov eax, esi
test al, al
je 0x5b2d50
cmp ebx, 0x200
je 0x5b2d50
mov eax, esi
cmp al, 0x2f
jne 0x5b2e10
cmp ebx, 2
je 0x5b2e14
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5b2e90
movzx esi, byte [edi]
jmp 0x5b2e14
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5b2d47
mov eax, 0xffffffe9
jmp 0x5b2d52
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5b2e61
jmp 0x5b2e7f
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x40cef0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x44c540], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x44c53c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x44c540], edx
cmp eax, 0x26f
jl 0x40cef8
mov dword [0x43dd70], 0x270
ret

Function at 0x40cf30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x44c544]
mov ebx, dword [eax*4 + 0x44c540]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x44cb74]
mov dword [eax*4 + 0x44c540], edx
cmp eax, 0xe2
jl 0x40cf38
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x44c544]
mov ebx, dword [eax*4 + 0x44c540]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x44c1b4]
mov dword [eax*4 + 0x44c540], edx
cmp eax, 0x26e
jl 0x40cf88
mov edx, dword [0x44c540]
mov ecx, dword [0x44cefc]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x44cb70]
mov dword [0x44cefc], eax
mov dword [0x43dd70], 0
pop ebx
ret

Function at 0x40d010
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x43dd70]
add dword [0x43dd70], 1
mov eax, dword [0x44b0f0]
cmp eax, dword [0x43d4c0]
jne 0x40d033
cmp ebx, 0x271
jb 0x40d054
mov eax, dword [0x44b0f0]
call fcn.0040cef0
not dword [0x44b0f0]
mov eax, dword [0x44b0f0]
mov dword [0x43d4c0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40d070
call fcn.0040cf30
xor ebx, ebx
mov dword [0x43dd70], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x44c540]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x40eb20
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x43d220]
cmp ax, 0xcb
je 0x40ec2c
cmp ax, 0xcc
je 0x40ec2c
lea esi, [esi]
mov edx, dword [0x44d140]
test edx, edx
je 0x40eb55
mov eax, dword [0x44cff0]
call edx
mov ebx, eax
jmp 0x40eb5a
mov ebx, 0x44cff4
cmp word [0x44cfe0], 0
jle 0x40eb80
mov eax, 0x44cfc0
call fcn.0040ed90
mov eax, ebx
call fcn.0040e6e0
mov eax, ebx
call fcn.0040e750
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40eba2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40eb9d
mov edx, edi
mov eax, ebx
call fcn.0040db50
jmp 0x40eba0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40eb88
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x44cfe0], 0
jle 0x40ec2c
mov edx, 0x44cf00
mov eax, ebx
call fcn.0040dc90
mov edi, eax
test edi, edi
je 0x40ebfc
mov eax, dword [0x44cf94]
mov dword [edi + 0xc], eax
cmp dword [0x44cf94], 0
je 0x40ebf0
mov eax, dword [0x44cf94]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x44cf94], eax
nop
sub word [0x44cfe0], 1
cmp word [0x44cfe0], 0
sete bl
mov eax, 0x44cfc0
call fcn.0040edb0
test bl, bl
je 0x40ec2c
mov eax, 0x44cfc0
call fcn.0040ed80
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x405020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x62f460]
sub esp, 0x78
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
je 0x40503c
cmp dword [eax + 0x30], 2
je 0x405197
push ebx
lea ecx, [esp + 0x2c]
call fcn.004f4ce0
mov ebx, dword [esi + 0x1c]
cmp ebx, edi
je 0x40518d
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.004ce0e0
lea ecx, [esp + 0x14]
push ecx
push 0x14
mov ecx, esi
call fcn.004730c0
mov dword [esp + 0xc], 0xa
jmp 0x405080
push 0x41f00000
push 0xc1f00000
call fcn.004bd540
fstp dword [esp + 0x5c]
mov edx, dword [esp + 0x2c]
push 0x41f00000
push 0xc1f00000
mov dword [esp + 0x20], edx
call fcn.004bd540
fadd dword [esp + 0x20]
push 0x40000000
push 0x3f000000
fstp dword [esp + 0x68]
mov dword [esp + 0x78], edi
mov dword [esp + 0x8c], 0x3f333333
mov dword [esp + 0x98], 0x3e4ccccd
call fcn.004bd540
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
or edx, 2
fmul dword [0x5da2d4]
mov dword [esp + 0x48], eax
add esp, 0x18
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], ecx
mov ecx, dword [0x6800e4]
fstp dword [esp + 0x4c]
push eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x5c], 0x66
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], edx
call fcn.004f54c0
mov esi, eax
cmp esi, edi
je 0x405183
push 0x3e99999a
push 0x3dcccccd
call fcn.004bd540
fmul dword [0x5da6e8]
add esp, 8
call fcn.0058c3f0
or dword [esi + 4], 1
mov ecx, dword [esi + 0x50]
add ecx, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x54], ecx
mov esi, dword [esi + 0x94]
cmp esi, edi
je 0x405183
push 0x40200000
push 0x3f800000
call fcn.004bd540
fstp dword [esi + 0x334]
add esp, 8
dec dword [esp + 0xc]
jne 0x405080
lea ecx, [esp + 0x2c]
call fcn.004031a0
pop ebx
pop edi
pop esi
add esp, 0x78
ret
Function at 0x40a340
Capabilities:
Get common file path

Disassembly:
sub esp, 0x200
push edi
push 0
push 5
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 4]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a360
mov ecx, dword [0x5da76c]
mov edx, dword [0x5da770]
mov ax, word [0x5da774]
mov dword [edi], ecx
mov cl, byte [0x5da776]
mov dword [edi + 4], edx
lea edx, [esp + 4]
push edx
mov word [edi + 8], ax
push 0x626e78
mov byte [edi + 0xa], cl
call fcn.0058c396
push 0x626e78
call fcn.004c2390
add esp, 0xc
push 0x626c78
push 0x200
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
pop edi
add esp, 0x200
ret

Function at 0x40a510
Capabilities:
Set current directory

Disassembly:
push esi
push str.CreateControlMapper
push 0x60
push str.ControlMapper.cpp
call fcn.004bdd70
push 0x26
push 0x10
call fcn.004be2d0
add esp, 0x14
test eax, eax
mov esi, 1
je 0x40a548
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], 0
jmp 0x40a54a
xor eax, eax
push 0x51
push 3
push esi
mov ecx, eax
mov dword [0x627078], eax
call fcn.0040a3e0
test al, al
jne 0x40a563
xor eax, eax
pop esi
ret
cmp dword [0x67fff8], esi
push 0
jne 0x40a574
push str.wingman.key
jmp 0x40a588
cmp dword [0x67fffc], esi
jne 0x40a583
push str.wingmanrumble.key
jmp 0x40a588
push str.default.key
mov ecx, dword [0x627078]
call fcn.004370f0
push edi
mov edi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
push 0x626e78
call edi
call fcn.004c3bc0
cmp dword [0x67fff8], esi
push 0
jne 0x40a5b7
push str.wcurrent.key
jmp 0x40a5cb
cmp dword [0x67fffc], esi
jne 0x40a5c6
push str.rcurrent.key
jmp 0x40a5cb
push str.current.key
mov ecx, dword [0x627078]
call fcn.004370f0
push 0x626c78
call edi
call fcn.004c3bc0
pop edi
mov eax, esi
pop esi
ret
Function at 0x40e970
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, dword [0x62f4ec]
sub esp, 0x38
cmp eax, 0xb7
jne 0x40e996
push 0
push 0
push str.A_version_of_CDS_II_is_currently_in_use.
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
add esp, 0x38
ret
push esi
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov esi, dword [esp + 0x40]
push 0
push 0
push 0
push 2
push 0x68
push esi
mov dword [0x62f37c], eax
call dword [sym.imp.user32.dll_LoadImageA]
test eax, eax
mov dword [0x62f37c], eax
jne 0x40e9ce
xor eax, eax
pop esi
add esp, 0x38
ret
push 0x65
push esi
mov dword [0x609684], 1
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0x40e7d0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], esi
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [esp + 0x28], eax
mov eax, dword [0x62f37c]
push 4
mov dword [esp + 0x30], eax
call dword [sym.imp.gdi32.dll_GetStockObject]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0x5dad64
call dword [sym.imp.user32.dll_RegisterClassA]
test ax, ax
je 0x40e9c7
push 0x258
push 0x320
push 0
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0
push 0xcb0000
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.user32.dll_AdjustWindowRect]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
push esi
push 0
push 0
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x18]
sub edx, ecx
push edx
push eax
push ecx
push 0xcb0000
push 0x5dad48
push 0x5dad64
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
test eax, eax
mov dword [0x62f41c], eax
mov dword [0x62f380], esi
je 0x40e9c7
mov ecx, dword [esp + 0x44]
push ecx
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov edx, dword [0x62f41c]
push edx
call dword [sym.imp.user32.dll_UpdateWindow]
mov eax, 1
pop esi
add esp, 0x38
ret
Function at 0x40ecb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x100
mov eax, dword [0x680580]
push ebx
xor ebx, ebx
cmp eax, ebx
push ebp
push esi
push edi
mov dword [0x680574], ebx
mov dword [0x680578], ebx
mov dword [0x68057c], ebx
je 0x40ee4f
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [0x680120]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0x10]
push eax
call fcn.004df110
mov ecx, dword [0x680120]
mov ebp, eax
mov eax, dword [ecx + 0x10]
push eax
call fcn.004df0d0
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x20], eax
mov eax, dword [0x680084]
fld dword [eax + 0x120]
mov ecx, dword [0x68008c]
fmul dword [0x5da6e8]
mov dword [esp + 0x10], ebx
fld dword [eax + 0x124]
mov dword [esp + 0x14], ebx
fmul dword [0x5da6e8]
fld dword [eax + 0x128]
fmul dword [0x5da6e8]
fstp dword [esp + 0x3c]
fxch st(1)
fadd dword [esp + 0x18]
fstp dword [esp + 0x18]
fld dword [esp + 0x1c]
fadd st(1)
fstp dword [esp + 0x1c]
fstp st(0)
fld dword [esp + 0x20]
fadd dword [esp + 0x3c]
fstp dword [esp + 0x20]
mov esi, dword [ecx + 0x1a38]
cmp esi, ebx
je 0x40ee16
lea ebx, [ebx]
xor eax, eax
mov ecx, 0x33
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x164]
test eax, eax
jne 0x40edc3
lea edx, [esi + 0x108]
mov eax, dword [edx]
mov dword [esp + 0x24], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x28], ecx
mov edx, dword [edx + 8]
mov dword [esp + 0x2c], edx
jmp 0x40edcf
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.004d2520
fld dword [esp + 0x28]
push 0
fadd dword [0x5da2d4]
push 0
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [0x68008c]
fstp dword [esp + 0x34]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.004e6130
test eax, eax
je 0x40ee06
inc dword [esp + 0x10]
jmp 0x40ee0a
inc dword [esp + 0x14]
mov esi, dword [esi + 0x1c]
inc ebx
test esi, esi
jne 0x40ed90
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x680574]
mov edx, dword [0x680578]
sub eax, edi
push eax
mov eax, dword [0x68057c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
push ebx
push str.TestRayCast_:_Count__d__Hit__d__Missed__d__TotalBSP__d_SkippedBSP__d__WastedBSP__d__time__dms_n
call fcn.004031a0
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f820
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
cmp eax, 1
jne 0x40f834
call fcn.0040cac0
mov al, byte [0x665e4c]
push ebx
push ebp
push esi
xor ebx, ebx
test al, 3
push edi
jne 0x40f856
push 0x72
call fcn.004c0ce0
add esp, 4
cmp eax, 1
je 0x40f856
xor esi, esi
jmp 0x40f85b
mov esi, 1
mov eax, dword [0x62f454]
mov ecx, dword [eax + 0x13d0]
test ecx, ecx
mov ebp, dword [esp + 0x11c]
jne 0x40f8c1
test ebp, ebp
je 0x40f88c
lea edx, [esp + 0x14]
mov eax, ebp
sub edx, ebp
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40f880
jmp 0x40f8a0
mov ecx, dword [str.Default]
mov edx, dword [0x5dafd8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
xor eax, eax
xor ebx, ebx
test esi, esi
sete al
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, dword [0x62f460]
call fcn.004fc3d0
cmp eax, 1
jne 0x40f8c1
mov ebx, eax
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
call esi
test ebx, ebx
mov ecx, dword [0x62f460]
mov edi, eax
jne 0x40f8e3
call fcn.004fcb30
mov ecx, dword [0x62f460]
push ebx
jmp 0x40f8e5
push 1
push str.GenStrs.loc
call fcn.004fc000
mov ecx, dword [0x62f460]
push 1
push str.PCStrs.loc
call fcn.004fc000
mov ecx, dword [0x62f460]
push 1
push str.InvStrs.loc
call fcn.004fc000
mov ecx, dword [0x62f460]
push 1
push 0x5dafa0
call fcn.004fc000
call esi
sub eax, edi
test eax, eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jge 0x40f93b
fadd dword [0x5da2fc]
fmul dword [0x5daf9c]
sub esp, 8
fstp qword [esp]
push str.Load_localisation_:__.2f_seconds_n
call fcn.004031a0
add esp, 0xc
pop edi
pop esi
test ebp, ebp
pop ebp
pop ebx
jne 0x40f96c
mov ecx, dword [0x62f460]
push str.Default
call fcn.004fc600
add esp, 0x108
ret
Function at 0x42d6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov eax, dword [0x680038]
mov eax, dword [eax + 0x41a38]
mov dword [esp], eax
fild dword [esp]
push ebx
push ebp
mov dword [esp + 0xc], eax
fcom dword [0x5ded58]
push esi
push edi
mov esi, ecx
fnstsw ax
test ah, 0x41
jne 0x42d6e5
fstp st(0)
fld dword [0x5ded58]
fild dword [esp + 0x14]
fsub st(1)
call fcn.0058c3f0
fstp st(0)
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 4], eax
mov ecx, dword [0x680038]
mov edx, dword [ecx + 0x41a38]
sub edx, eax
mov dword [esi + 0xc], edx
mov eax, dword [0x680038]
mov eax, dword [eax + 0x41a3c]
sub eax, 0x1ca
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 8], eax
push 1
add eax, 0x1ca
push 0x42c80000
mov dword [esi + 0x10], eax
mov ecx, dword [0x62f434]
push 0x42c80000
call fcn.0052b1e0
mov ecx, dword [0x62f434]
push 2
call fcn.0052b5e0
call fcn.0058c3f0
mov edi, dword [esi + 8]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
movzx eax, ax
add edi, eax
mov dword [esi + 0x18], edi
mov edi, dword [esi + 0x10]
mov ebx, dword [esi + 0x18]
add ecx, 0x30
sub edi, eax
add edx, 0xffffffcf
mov dword [esi + 0x20], edi
dec edi
mov dword [esi + 0x14], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x54], ecx
add ecx, 0xa
mov dword [esi + 0x40], edi
sub edi, eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x48], ebx
add ebx, eax
mov dword [esi + 0x4c], edx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x24], ecx
lea ecx, [edx - 0xa]
lea edx, [ebx + 0xa]
mov dword [esi + 0x38], edi
add edi, 0xfffffffa
lea eax, [edx + eax*8 + 0x1c]
mov dword [esi + 0x28], edx
mov dword [esi + 0x78], edx
add edx, 0x104
mov dword [esi + 0x60], edi
lea edi, [ecx - 0x100]
mov dword [esi + 0x80], edx
lea ebp, [ebx + 6]
add edx, 6
mov dword [esi + 0x74], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebp
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x43aeb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6800cc]
mov ecx, dword [eax + 8]
test ecx, ecx
jne case.0x43aee2.11
call fcn.0043ba50
test eax, eax
je case.0x43aee2.11
mov eax, dword [0x60d4f4]
test eax, eax
je case.0x43aee2.11
mov eax, dword [0x63433c]
add eax, 0xfffffff5
cmp eax, 9
ja case.0x43aee2.13
movzx ecx, byte [eax + 0x43af08]
jmp dword [ecx*4 + 0x43af00]
mov ecx, dword [esp + 4]
imul ecx, ecx, 0x58c
add ecx, 0x62ff7c
jmp fcn.0043a990
ret