joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b490
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5745bc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00428380
xor ebx, ebx
lea ecx, [esi + 0x218]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CBigMapDlg.0
call fcn.0045dac0
lea edi, [esi + 0x290]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [esi + method.CMemoryPoolTempl_class_CMiniMapIcon_.virtual_0], vtable.CMemoryPoolTempl_class_CMiniMapIcon_.0
mov dword [esi + 0x2b8], ebx
mov dword [esi + 0x2bc], ebx
mov byte [esi + 0x2c4], bl
push 0x45dc40
push fcn.004248e0
push 0x14
push 0xc
lea eax, [esi + 0x444]
push eax
mov byte [esp + 0x30], 3
call fcn.0055c3bc
lea ecx, [esi + 0x538]
mov byte [esp + 0x1c], 4
call fcn.00445ab0
lea ecx, [esi + 0x55c]
mov byte [esp + 0x1c], 5
call fcn.0042d050
lea ecx, [esi + 0x57c]
mov byte [esp + 0x1c], 6
call fcn.0045dc60
push fcn.0042d060
push fcn.0042d050
push 6
push 0x20
lea ecx, [esi + 0x60c]
push ecx
mov byte [esp + 0x30], 7
call fcn.0055c3bc
push 0x40
mov ecx, edi
mov byte [esp + 0x20], 8
call fcn.005179e0
push 0x80
lea edx, [esi + 0x2c4]
push 0x584468
push edx
call fcn.0055bf40
lea edi, [esi + 0x2b8]
add esp, 0xc
mov dword [esi + 0x2c0], 0xa
cmp dword [edi], ebx
jne 0x45b5c5
push 0x64
push edi
call fcn.0045b220
mov eax, dword [edi]
add esp, 8
mov dword [esi + 0x2bc], eax
fldz
mov dword [esi + 0x1b8], 0x78ffffff
fst dword [esi + 0x5f4]
mov dword [esi + 0x5e8], 1
fstp dword [esi + 0x5f8]
mov dword [esi + 0x5ec], ebx
mov dword [esi + 0x5f0], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x45d2f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x574766
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00428380
xor ebx, ebx
lea ecx, [esi + 0x228]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CMiniMapDlg.0
call fcn.0045dac0
lea edi, [esi + 0x2a0]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [esi + method.CMemoryPoolTempl_class_CMiniMapIcon_.virtual_0], vtable.CMemoryPoolTempl_class_CMiniMapIcon_.0
mov dword [esi + 0x2c8], ebx
mov dword [esi + 0x2cc], ebx
mov byte [esi + 0x2d4], bl
push 0x45dc40
push fcn.004248e0
push 0x11
push 0xc
lea eax, [esi + 0x454]
push eax
mov byte [esp + 0x30], 3
call fcn.0055c3bc
push 0x45bb60
push 0x45bb50
push 2
push 0x28
lea ecx, [esi + 0x524]
push ecx
mov byte [esp + 0x30], 4
call fcn.0055c3bc
lea ecx, [esi + 0x574]
mov byte [esp + 0x1c], 5
call fcn.0042d050
mov byte [esp + 0x1c], 6
lea eax, [esi + 0x5b4]
lea ecx, [ebx + 0xa]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
add eax, 0xc
sub ecx, 1
jns 0x45d3c5
mov eax, 0x63
lea ecx, [esi + 0x740]
mov dword [esi + 0x69c], eax
mov dword [esi + 0x6a0], ebx
mov byte [esi + 0x6a4], bl
mov dword [esi + 0x6a8], eax
mov dword [esi + 0x6ac], ebx
mov byte [esi + 0x6b0], bl
mov dword [esi + 0x6b4], eax
mov dword [esi + 0x6b8], ebx
mov byte [esi + 0x6bc], bl
mov dword [esi + 0x6c0], eax
mov dword [esi + 0x6c4], ebx
mov byte [esi + 0x6c8], bl
mov dword [esi + 0x6cc], eax
mov dword [esi + 0x6d0], ebx
mov byte [esi + 0x6d4], bl
mov dword [esi + 0x6d8], eax
mov dword [esi + 0x6dc], ebx
mov byte [esi + 0x6e0], bl
mov dword [esi + 0x6e4], eax
mov dword [esi + 0x6e8], ebx
mov byte [esi + 0x6ec], bl
mov dword [esi + 0x6f0], eax
mov dword [esi + 0x6f4], ebx
mov byte [esi + 0x6f8], bl
mov dword [esi + 0x6fc], eax
mov dword [esi + 0x700], ebx
mov byte [esi + 0x704], bl
call fcn.0045dc60
push fcn.0042d060
push fcn.0042d050
push 6
push 0x20
lea edx, [esi + 0x7ac]
push edx
mov byte [esp + 0x30], 7
call fcn.0055c3bc
push 0x40
mov ecx, edi
mov byte [esp + 0x20], 8
mov dword [esi + 0x218], ebx
mov dword [esi + 0x21c], ebx
mov dword [esi + 0x220], ebx
call fcn.005179e0
fld dword [0x584528]
fstp dword [esi + 0x5ac]
push 0x80
fld dword [0x584524]
lea eax, [esi + 0x2d4]
fstp dword [esi + 0x5b0]
push 0x584468
fldz
push eax
fst dword [esi + 0x5a4]
fstp dword [esi + 0x5a8]
mov dword [esi + 0x548], ebx
mov dword [esi + 0x544], ebx
mov dword [esi + 0x570], ebx
mov dword [esi + 0x56c], ebx
call fcn.0055bf40
lea edi, [esi + 0x2c8]
add esp, 0xc
mov dword [esi + 0x2d0], 0xa
cmp dword [edi], ebx
jne 0x45d544
push 0x64
push edi
call fcn.0045b220
mov ecx, dword [edi]
add esp, 8
mov dword [esi + 0x2cc], ecx
fldz
mov dword [esi + 0x720], ebx
fst dword [esi + 0x728]
mov dword [esi + 0x724], ebx
fstp dword [esi + 0x72c]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x464720
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0xc
push esi
push edi
push 0x57e610
push str.._image_InterfaceScript_Channel.bin
mov ecx, 0x6993d0
call fcn.0043ead0
fild dword [0x6d8860]
mov esi, eax
mov eax, dword [0x6d8860]
test eax, eax
jge 0x412460
fadd dword [0x57e5c0]
fsub qword [0x57f018]
mov ecx, dword [0x6d8864]
fld qword [0x57f010]
fmul st(1), st(0)
fld dword [esi + 0x1c4]
faddp st(2)
fxch st(1)
fstp dword [esp + 0xc]
fild dword [0x6d8864]
test ecx, ecx
jge 0x412492
fadd dword [0x57e5c0]
fsub qword [0x57f008]
mov edi, dword [esi]
fmulp st(1)
fadd dword [esi + 0x1c8]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
call fcn.0055b110
fld dword [esp + 0xc]
push eax
call fcn.0055b110
mov edx, dword [edi + 0x24]
push eax
mov ecx, esi
call edx
mov ecx, dword [0x6993e8]
push esi
call fcn.005584f0
push 0x597
mov ecx, 0x6993d0
call fcn.00440960
pop edi
pop esi
test eax, eax
je 0x4124ec
mov ecx, eax
add esp, 0xc
jmp 0x464720
add esp, 0xc
ret
push 0xffffffffffffffff
push 0x577d48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0042d050
push 0
lea eax, [esp + 0xc]
push eax
push 0x3f
mov ecx, 0x6b6658
mov dword [esp + 0x3c], 0
call fcn.00431a60
mov edx, dword [esi]
mov eax, dword [edx + 0x60]
push 0x598
mov ecx, esi
call eax
mov edx, dword [esi]
mov dword [esi + 0x21c], eax
mov eax, dword [edx + 0x60]
push 0x59b
mov ecx, esi
call eax
push 0x1e1e1e
lea ecx, [esp + 0xc]
push ecx
push 0xff00ff00
push 0x9a5
mov ecx, 0x6b8950
mov dword [esi + 0x220], eax
call fcn.004c5020
mov ecx, dword [esi + 0x220]
push eax
call fcn.0043e400
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.0042d060
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x467080
Capabilities:
Get number of processors

Disassembly:
mov ecx, dword [ecx + 0x228]
jmp 0x467080
push 0xffffffffffffffff
push 0x574beb
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x467229
cmp dword [ebx + 0x40], 0
lea edi, [ebp + 0x2e4]
mov ecx, edi
jne 0x4671a7
call fcn.00558a40
mov dword [esp + 0x30], eax
test eax, eax
je 0x4670f9
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.00558aa0
mov esi, dword [eax]
test esi, esi
je 0x4670f9
mov eax, dword [ebx + 0x3c]
cmp dword [esi + 8], eax
je 0x467106
cmp dword [esp + 0x30], 0
jne 0x4670d8
push ebx
mov ecx, ebp
call fcn.00465e10
jmp 0x467222
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00558a40
mov dword [esp + 0x18], eax
test eax, eax
je 0x467137
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.00558aa0
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
je 0x467229
cmp dword [esp + 0x18], 0
jne 0x467118
mov ebp, 1
push ebx
mov ecx, edi
mov dword [esi], ebp
call fcn.00558460
add dword [esi + 4], ebp
push 0x48
call fcn.0055a781
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x46716c
mov ecx, eax
call fcn.004e48d0
jmp 0x46716e
xor eax, eax
mov edx, dword [ebx + 0x3c]
mov ecx, edx
imul ecx, ecx, 0x64
add ecx, 0x63
mov dword [eax + 0x44], ecx
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0xffffffff
mov dword [eax + 0x3c], edx
mov dword [eax + 0x40], 0x63
call fcn.005584f0
mov eax, dword [esp + 0x14]
add dword [esi + 4], ebp
add dword [eax + 0x2e0], ebp
mov ebp, eax
jmp 0x467222
call fcn.00558a40
mov dword [esp + 0x1c], eax
test eax, eax
je 0x46721a
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00558aa0
mov esi, dword [eax]
test esi, esi
je 0x46721a
mov eax, dword [esi + 8]
cmp eax, dword [ebx + 0x3c]
je 0x4671d7
cmp dword [esp + 0x1c], 0
jne 0x4671b4
jmp 0x46721a
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00558a70
mov ebp, eax
test ebp, ebp
je 0x467216
mov ecx, edi
call fcn.005589f0
mov eax, dword [eax]
cmp dword [eax + 0x40], 0x63
push ebx
mov ecx, edi
jne 0x467208
push ebp
call fcn.005586c0
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x467222
call fcn.005584f0
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x467222
mov ebp, dword [esp + 0x14]
push ebx
mov ecx, ebp
call fcn.00465f20
mov ecx, ebp
call fcn.00466ca0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov ecx, dword [0x6a98fc]
jmp 0x465930
Function at 0x46cdb0
Capabilities:
Print debug messages

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
mov ebx, ecx
test eax, eax
jne 0x46cdd0
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
ret 4
push esi
push eax
mov ecx, 0x6b79b8
call fcn.0049e730
mov esi, eax
test esi, esi
je 0x46cdef
mov ax, word [edi + 6]
mov word [esi + 0x28e], ax
jmp 0x46ce1d
push str.CItemShopGridDialog::AddItem
push edi
mov ecx, 0x6b79b8
call fcn.004a19c0
mov esi, eax
test esi, esi
jne 0x46ce0b
pop esi
pop edi
pop ebx
ret 4
push esi
mov ecx, 0x6b79b8
mov dword [esi + 0x24], 1
call fcn.004aa980
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx eax, ax
movzx eax, ax
sub eax, 0xf0
cdq
mov ecx, 0x1e
idiv ecx
push esi
mov ecx, ebx
push edx
call fcn.0042ccb0
pop esi
pop edi
pop ebx
ret 4
Function at 0x481200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57552e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00428380
lea edi, [esi + 0x21c]
mov ecx, edi
mov dword [esp + 0x38], 0
mov dword [esi], vtable.CUniqueItemCurseCancellationDlg.0
call fcn.004b4e30
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
mov dword [esi + 0x218], 0
mov word [esi + 0x4a8], ax
call fcn.0042d050
push 0
lea ecx, [esp + 0x14]
push ecx
push 0xf4
mov ecx, 0x6b6658
mov byte [esp + 0x44], 2
call fcn.00431a60
push 0x33517d
lea edx, [esp + 0x14]
push edx
push 0xffffff
push 0x57ea62
mov ecx, edi
call fcn.0043e400
push 0
mov ecx, edi
call fcn.0040b220
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
call fcn.0042d060
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x481690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57552e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00428380
lea edi, [esi + 0x21c]
mov ecx, edi
mov dword [esp + 0x38], 0
mov dword [esi], vtable.CUniqueItemMixDlg.0
call fcn.004b4e30
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
mov dword [esi + 0x218], 0
mov dword [esi + 0x4ac], 0
call fcn.0042d050
push 0
lea eax, [esp + 0x14]
push eax
push 0xf4
mov ecx, 0x6b6658
mov byte [esp + 0x44], 2
call fcn.00431a60
push 0x33517d
lea ecx, [esp + 0x14]
push ecx
push 0xffffff
push 0x57ea62
mov ecx, edi
call fcn.0043e400
push 0
mov ecx, edi
call fcn.0040b220
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
call fcn.0042d060
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x4837e5
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp ebx, 1
jne 0x483825
mov eax, dword [0x6b7c78]
push edi
add eax, 0x1d4c0
lea edi, [esi + 0x284]
mov ecx, edi
mov dword [esi + 0x238], eax
call fcn.00445ac0
push str.ANRaster.tga
mov ecx, edi
call fcn.00445af0
pop edi
push ebx
mov ecx, esi
call fcn.00428980
pop esi
pop ebx
ret 4
lea ecx, [esi + 0x284]
call fcn.00445ac0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.00428980
pop esi
pop ebx
ret 4

Function at 0x483850
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp ebx, 1
jne 0x48389b
mov eax, dword [esp + 0x10]
imul eax, eax, 0x3e8
add eax, dword [0x6b7c78]
push edi
lea edi, [esi + 0x284]
mov ecx, edi
mov dword [esi + 0x238], eax
call fcn.00445ac0
push str.ANRaster.tga
mov ecx, edi
call fcn.00445af0
pop edi
push ebx
mov ecx, esi
call fcn.00428980
pop esi
pop ebx
ret 8
lea ecx, [esi + 0x284]
call fcn.00445ac0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.00428980
pop esi
pop ebx
ret 8
Function at 0x485100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x575638
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0xa
lea ecx, [esp + 0x18]
call fcn.00558110
lea edi, [esi + 0x80]
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.00558a40
mov dword [esp + 0xc], eax
test eax, eax
je 0x4851b9
nop
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00558aa0
mov esi, dword [eax]
test esi, esi
je 0x4851b2
fld dword [esi + 0x28c]
push ecx
fstp dword [esp + 0x14]
lea ecx, [esi + 0x284]
fld dword [esp + 0x14]
fcom qword [0x587988]
fnstsw ax
test ah, 1
jne 0x48519c
fstp st(0)
fld1
fstp dword [esp]
call fcn.0052a180
push esi
lea ecx, [esp + 0x18]
call fcn.005584f0
jmp 0x4851b2
fadd qword [0x587980]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.0052a180
cmp dword [esp + 0xc], 0
jne 0x485150
lea ecx, [esp + 0x14]
call fcn.00558a40
mov dword [esp + 0xc], eax
test eax, eax
je 0x4851f3
lea ebx, [ebx]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.00558aa0
mov eax, dword [eax]
test eax, eax
je 0x4851ec
push eax
mov ecx, edi
call fcn.00558ba0
cmp dword [esp + 0xc], 0
jne 0x4851d0
lea ecx, [esp + 0x14]
call fcn.005581f0
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.00558270
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x48a380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x575b8e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x38], eax
lea ebx, [ebx]
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x48a42f
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov dword [ebx + 0x38], edx
test ecx, ecx
je 0x48a42f
mov ecx, dword [ecx + 0x538]
test ecx, ecx
je 0x48a41b
test byte [0x6a8c98], 1
movzx esi, word [ecx + 0x3b]
jne 0x48a40b
or dword [0x6a8c98], 1
mov ecx, 0x6a8b28
mov dword [esp + 0x14], 0
call fcn.0051e090
push 0x57cb50
call fcn.0055a990
add esp, 4
mov dword [esp + 0x14], 0xffffffff
push esi
mov ecx, 0x6a8b28
call fcn.0051cca0
cmp eax, 1
jne 0x48a3b0
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x493b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x575f98
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
cmp dword [ecx + 0x120], 1
je 0x493be6
push 0
push 0x23e
push str.Object.cpp
call fcn.0050ea20
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov ebx, dword [esp + 0x38]
lea esi, [ecx + 0x18]
xor edx, edx
mov eax, ebx
div dword [esi + 4]
mov eax, dword [esi + 8]
push 0xa
mov ecx, dword [eax + edx*4]
mov dword [esi + 0x18], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ebx
call fcn.00558110
mov dword [esp + 0x30], 0
lea ebx, [ebx]
cmp dword [esi + 0x18], 0
je 0x493c41
mov ecx, dword [esi + 0x20]
lea esp, [esp]
mov eax, dword [esi + 0x18]
cmp dword [eax], ecx
je 0x493c9f
mov edx, dword [eax + 0xc]
mov dword [esi + 0x18], edx
test edx, edx
jne 0x493c30
lea ecx, [esp + 0xc]
call fcn.00558a40
mov dword [esp + 0x38], eax
test eax, eax
je 0x493c71
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x10]
call fcn.00558aa0
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.00431cf0
cmp dword [esp + 0x38], 0
jne 0x493c52
lea ecx, [esp + 0xc]
call fcn.005581f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00558270
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov dword [esi + 0x1c], eax
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x493c41
push eax
mov ecx, 0x6dc228
call fcn.0053d480
cmp eax, 1
jne 0x493c20
push ebx
lea ecx, [esp + 0x10]
call fcn.005584f0
jmp 0x493c20
Function at 0x4a19c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5763e9
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x6a7564]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x18c]
mov edi, ecx
movzx ecx, word [ebx + 4]
xor edx, edx
mov eax, ecx
div dword [edi + 0x50]
mov eax, dword [edi + 0x54]
mov esi, dword [esp + 0x190]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4a1a33
cmp dword [eax], ecx
je 0x4a1a2d
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4a1a20
jmp 0x4a1a33
cmp dword [eax + 4], 0
jne 0x4a1a6f
push esi
push ecx
mov ecx, dword [0x6b6da0]
push ecx
lea edx, [esp + 0x84]
push str.NoItemInfo__d____d____s
push edx
call fcn.0055adac
lea eax, [esp + 0x8c]
push eax
push 0x166
push str.ItemManager.cpp
call fcn.0050ea20
add esp, 0x20
xor eax, eax
jmp 0x4a1b88
mov ebp, dword [ebx]
test ebp, ebp
je 0x4a1a68
push ebp
mov ecx, edi
call fcn.0049e730
mov esi, eax
test esi, esi
jne 0x4a1b5f
push 0x3b8
call fcn.0055a781
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x184], esi
cmp eax, esi
je 0x4a1aad
push ebx
mov ecx, eax
call fcn.0049ba00
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x74]
mov ecx, esi
mov dword [esp + 0x184], 0xffffffff
call eax
push eax
push esi
lea ecx, [edi + 0x28]
call fcn.0051a990
lea ecx, [esp + 0x18]
call fcn.0042d050
mov ebx, dword [esi]
lea ecx, [edi + 0x270]
mov dword [esp + 0x184], 1
add ebx, 0x10
call fcn.00558d30
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x78]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.004a1970
mov edx, dword [ebx]
push eax
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
mov ecx, esi
mov dword [esi + 0x21c], 1
call edx
movzx eax, ax
mov dword [esi + 0x220], eax
xor eax, eax
mov word [esi + 0x2a8], ax
mov ecx, dword [0x6993e8]
push esi
call fcn.005584f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x184], 0xffffffff
call fcn.0042d060
jmp 0x4a1b86
push ebp
lea ecx, [esp + 0x3c]
push str.__DBIndex:__d
push ecx
call fcn.0055adac
lea edx, [esp + 0x44]
push edx
push 0x18e
push str.ItemManager.cpp
call fcn.0050ea20
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0055a677
add esp, 0x174
ret 8
Function at 0x4a6430
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x6a7564]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebx
cmp dword [esi + 0x104], 0
jne 0x4a645f
mov dword [esi + 0x104], eax
sub eax, dword [esi + 0x104]
cmp eax, 0x1388
jbe 0x4a654d
mov eax, dword [esi + 0xe0]
mov ecx, dword [esi + 0xec]
mov dword [esi + 0xf4], ecx
test eax, eax
jle 0x4a64a7
mov ecx, eax
jmp 0x4a6490
mov eax, dword [esi + 0xf4]
test eax, eax
je 0x4a64a2
mov edx, dword [eax]
mov dword [esi + 0xf4], edx
sub ecx, 1
jne 0x4a6490
push edi
push 0
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4a654c
lea eax, [esp + 0xc]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4a653d
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x138]
push 0x57e8e8
push edx
call fcn.0055adac
add esp, 0xc
lea eax, [esp + 0x134]
push eax
mov ecx, esi
call fcn.004a1660
test eax, eax
je 0x4a652e
mov ecx, 0x6a4e78
call fcn.0050deb0
push 0x230
mov ecx, 0x6b8950
call fcn.004c5020
push eax
push 1
push 0x179e
push 0x6993d0
call fcn.00443430
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4a64d3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [esi + 0x104], eax
pop edi
mov ecx, dword [esp + 0x1b0]
pop esi
pop ebx
xor ecx, esp
call fcn.0055a677
add esp, 0x1ac
ret
Function at 0x4b78d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x69b219], 0
push esi
mov esi, ecx
je 0x4b78f3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x6b7c7c], eax
mov byte [0x69b219], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x6b7c7c], eax
cmp eax, ecx
jae 0x4b790a
dec edx
mov dword [0x6b7c74], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x6b7c74]
add dword [0x6b7c78], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x4b7934
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x4bf2a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bf2cf
pop edi
xor eax, eax
pop esi
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x520
lea edx, [edi + 0x524]
push edx
push esi
call ebx
test eax, eax
jne 0x4bf2ff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
ret 4
push 0
lea eax, [esp + 0x14]
push eax
push 0xc0
add edi, 0xb04
push edi
push esi
call ebx
push esi
test eax, eax
je 0x4bf2f1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
ret 4