joyce8/EMBER2024-capa huggingface dataset:
Function at 0x909c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xa6f40a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.EvilReportManager.0
lea ecx, [esi + 0x1c98]
mov dword [esp + 0x14], 3
call fcn.00909b60
push fcn.00909a20
push 5
push 0x1e0
lea eax, [esi + 0x1338]
push eax
mov byte [esp + 0x24], 2
call fcn.00a2a35b
push fcn.00909a20
push 0xa
push 0x1e0
lea ecx, [esi + 0x78]
push ecx
mov byte [esp + 0x24], 1
call fcn.00a2a35b
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 0
call fcn.0090a240
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0xffffffff
call fcn.0090a240
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x912330
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0xa6d248
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
call fcn.0090ca50
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov ebp, dword [eax + 8]
call fcn.00626140
xor ecx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x7f8
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ecx
add dword [esp + 0x1c], 0x10
lea eax, [esp + 0x14]
push eax
push 0x2b7d
mov ecx, esi
call fcn.0090eb40
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.00626120
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x91d780
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xa4cb38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
xor ebx, ebx
push ebx
call fcn.0090d400
test al, al
je 0x91d7e2
mov eax, dword [0xce1d00]
mov eax, dword [eax + 0x570]
mov eax, dword [eax + 0x8198]
dec eax
cmp eax, 0xc
ja case.0x91d7cd.6
jmp dword [eax*4 + 0x91d89c]
mov eax, 1
mov ecx, dword [esi + 8]
push eax
call fcn.009283d0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
mov eax, 2
jmp 0x91d7d9
mov eax, 3
jmp 0x91d7d9
mov eax, 4
jmp 0x91d7d9
mov eax, 5
jmp 0x91d7d9
mov eax, 6
jmp 0x91d7d9
mov eax, 7
jmp 0x91d7d9
mov eax, 8
jmp 0x91d7d9
mov eax, 9
jmp 0x91d7d9
xor ecx, ecx
mov word [esp + 0xc], cx
mov byte [esp + 0xf], 1
mov byte [esp + 0xe], bl
call fcn.00626140
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x7f8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0xc]
mov dword [eax], edx
add dword [esp + 0x18], 4
lea eax, [esp + 0x10]
push eax
push 0x2c07
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.0090eb40
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esp + 0x2c], 0xffffffff
call fcn.00626120
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x9233d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0xa4c368
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00626140
xor ecx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x7f8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
add dword [esp + 0x10], 4
push edx
lea ecx, [esp + 0xc]
call fcn.005930a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov dl, byte [esp + 0x30]
mov byte [eax + ecx], dl
inc dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
call fcn.00593100
lea ecx, [esp + 8]
push ecx
push 0x2c8c
mov ecx, esi
call fcn.0090eb40
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x24], 0xffffffff
call fcn.00626120
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0x1c
Function at 0x9258a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xa6f5f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x20
push 0x40
call fcn.0078f9b0
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [ecx + 4], 0x20
mov dword [ecx], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], ebx
call fcn.00924450
mov byte [esi + 0x44], bl
mov byte [esi + 0x74], bl
lea eax, [esi + 0x30]
lea ecx, [esi + 0xb0]
mov edx, vtable.phListSpace::_phListIteratorBase_struct_std::pair_struct_sTeamMatchScore__struct_sTeamMatchScore___unsigned_long_long_unsigned___int64___struct_Int64HashGen_.0
mov dword [eax + 0x70], edx
mov byte [eax + 4], bl
mov dword [eax + 0x74], eax
mov dword [eax + 0x78], eax
mov byte [ecx + 0x14], bl
mov byte [ecx + 0x44], bl
mov dword [ecx + 0x70], edx
mov byte [ecx + 4], bl
mov dword [ecx + 0x74], ecx
mov dword [ecx + 0x78], ecx
mov dword [esi + 0x128], eax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0x130], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x9259e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xa6f5f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x20
push 0x40
call fcn.0078f9b0
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [ecx + 4], 0x20
mov dword [ecx], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], ebx
call fcn.00924570
mov byte [esi + 0x44], bl
mov byte [esi + 0x74], bl
lea eax, [esi + 0x30]
lea ecx, [esi + 0xb0]
mov edx, vtable.phListSpace::_phListIteratorBase_struct_std::pair_struct_sDeathMatchScore__struct_sDeathMatchScore___unsigned_long_long_unsigned___int64___struct_Int64HashGen_.0
mov dword [eax + 0x70], edx
mov byte [eax + 4], bl
mov dword [eax + 0x74], eax
mov dword [eax + 0x78], eax
mov byte [ecx + 0x14], bl
mov byte [ecx + 0x44], bl
mov dword [ecx + 0x70], edx
mov byte [ecx + 4], bl
mov dword [ecx + 0x74], ecx
mov dword [ecx + 0x78], ecx
mov dword [esi + 0x128], eax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0x130], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x925b20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xa6f5f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x20
push 0x40
call fcn.0078f9b0
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [ecx + 4], 0x20
mov dword [ecx], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], ebx
call fcn.00924690
mov byte [esi + 0x44], bl
mov byte [esi + 0x74], bl
lea eax, [esi + 0x30]
lea ecx, [esi + 0xb0]
mov edx, vtable.phListSpace::_phListIteratorBase_struct_std::pair_struct_sMonsterMatchScore__struct_sMonsterMatchScore___unsigned_long_long_unsigned___int64___struct_Int64HashGen_.0
mov dword [eax + 0x70], edx
mov byte [eax + 4], bl
mov dword [eax + 0x74], eax
mov dword [eax + 0x78], eax
mov byte [ecx + 0x14], bl
mov byte [ecx + 0x44], bl
mov dword [ecx + 0x70], edx
mov byte [ecx + 4], bl
mov dword [ecx + 0x74], ecx
mov dword [ecx + 0x78], ecx
mov dword [esi + 0x128], eax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0x130], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x92ae40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0xa4c368
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
call fcn.0092ac50
test al, al
je 0x92af08
call fcn.00626140
xor ecx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x7f8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov byte [eax], 1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
inc eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + edx], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 8]
mov dword [ecx + edx + 4], eax
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], 8
push eax
lea ecx, [esp + 0xc]
call fcn.005930a0
lea ecx, [esp + 8]
push ecx
push 0x2e1d
mov ecx, 0xdafd38
call fcn.008f1d70
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x24], 0xffffffff
call fcn.00626120
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc
mov eax, dword [0xce1d00]
mov esi, dword [eax + 0x570]
push 0
push 1
push str.HelpReq_Fail6
push str.AngelSystemStrings
mov ecx, 0xdacba0
call fcn.008e2b00
push eax
mov ecx, esi
call fcn.00632870
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc
Function at 0x935040
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xa70dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x18]
lea esi, [ebx + 0x18]
lea edx, [ecx*4 + 4]
push edx
push 0
push eax
call fcn.00a2a210
add esp, 0xc
lea ecx, [esi + 8]
call fcn.00922e80
lea ecx, [esi + 0x1c]
call fcn.009349e0
lea ecx, [esi + 0x2c]
lea edx, [esi + 0x250]
mov dword [esi + 0x470], ecx
mov dword [esi + 0x248], edx
mov dword [esi + 0x474], 0
mov edi, dword [ebx + 0xc]
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.00935000
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
mov dword [esp + 0x3c], 0
call fcn.00935020
mov edi, dword [esp + 0x28]
cmp edi, dword [eax + 4]
mov edx, dword [0xce4538]
setne al
mov dword [esp + 0x14], vtable.phListSpace::_phListIterator_struct_sEventSceneScript__int__struct_IntHashGen_.0
mov dword [esp + 0x18], edx
test al, al
je 0x93515f
mov ecx, dword [ebp + 8]
cmp dword [edi + 0xc], ecx
lea eax, [edi + 8]
jne 0x93512c
push eax
push eax
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.004ad810
mov eax, dword [0xce4538]
mov dword [esp + 0x1c], vtable.phListSpace::_phListIterator_struct_sEventSceneScript__int__struct_IntHashGen_.0
mov dword [esp + 0x20], eax
mov edi, dword [edi + 0x220]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x2c], edi
call fcn.00935020
cmp edi, dword [eax + 4]
mov edx, dword [0xce4538]
setne al
mov dword [esp + 0x14], vtable.phListSpace::_phListIterator_struct_sEventSceneScript__int__struct_IntHashGen_.0
mov dword [esp + 0x18], edx
test al, al
jne 0x935102
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x93a8b0
Capabilities:
Get number of processors

Disassembly:
mov ecx, dword [ecx + 0x4fc]
test ecx, ecx
jne 0x93a8bf
xor eax, eax
ret 4
jmp fcn.008992b0
Function at 0x957800
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xa6f5f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x20
push 0x40
call fcn.0078f9b0
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [ecx + 4], 0x20
mov dword [ecx], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], ebx
call fcn.00956440
lea eax, [esi + 0x30]
lea ecx, [esi + 0x58]
mov edx, vtable.phListSpace::_phListIteratorBase_class_MCBuyItemContent___long_long___int64___struct_Int64HashGen_.0
mov dword [eax + 0x18], edx
mov byte [eax + 4], bl
mov dword [eax + 0x1c], eax
mov dword [eax + 0x20], eax
mov dword [ecx + 0x18], edx
mov byte [ecx + 4], bl
mov dword [ecx + 0x1c], ecx
mov dword [ecx + 0x20], ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x80], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x95a870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xa6f5f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x20
push 0x40
call fcn.0078f9b0
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [ecx + 4], 0x20
mov dword [ecx], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], ebx
call fcn.00950af0
lea eax, [esi + 0x30]
lea ecx, [esi + 0x58]
mov edx, vtable.phListSpace::_phListIteratorBase_class_GridTreeProxyContent_long_long___int64___struct_Int64HashGen____long_long___int64___struct_Int64HashGen_.0
mov dword [eax + 0x18], edx
mov byte [eax + 4], bl
mov dword [eax + 0x1c], eax
mov dword [eax + 0x20], eax
mov dword [ecx + 0x18], edx
mov byte [ecx + 4], bl
mov dword [ecx + 0x1c], ecx
mov dword [ecx + 0x20], ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x80], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x961450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xa72f50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov al, byte [esp + 0x30]
mov byte [edi + 0x1c], al
mov ecx, dword [0xdb7fe8]
mov esi, dword [ecx + 0xc]
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.0095bc50
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.0095bc30
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x28], 1
cmp esi, ebx
je 0x9614f2
lea esp, [esp]
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x9614e7
cmp byte [edi + 0x1c], 0
sete dl
movzx ecx, dl
mov edx, dword [0xdbaba0]
push ecx
mov ecx, dword [edx + 0x80]
push eax
call fcn.0096be90
mov esi, dword [esi + 0x20]
mov dword [esp + 0x14], esi
cmp esi, ebx
jne 0x9614c0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x9650f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
cmp dword [ecx + 0x12c], 0
mov dword [esp + 0x1c], ecx
jne 0x965118
mov eax, dword [esp + 0x30]
mov ecx, 0x960
mov edx, ecx
mov word [eax], cx
mov word [eax + 2], dx
add esp, 0x2c
ret 4
lea eax, [esp + 0x24]
push eax
add ecx, 0xc8
call fcn.00964be0
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 8]
mov edx, dword [0xdba5a4]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], vtable.phListSpace::_phListConstIterator_class_MCCellObjSpace___struct_MCCellKey__struct_MCCellKeyHashGen_.0
movzx ecx, word [eax + 0x96]
movzx eax, word [eax + 0x94]
mov word [esp + 6], cx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
mov word [esp + 0xc], ax
call fcn.0062f510
mov eax, dword [0xce1d00]
mov ecx, dword [eax + 0x388]
mov dword [esp + 0x1c], ecx
mov cx, word [eax + 0x3b0]
mov ax, word [eax + 0x3b2]
add esp, 8
cmp cx, ax
mov word [esp + 0x10], cx
jge 0x965196
movzx eax, cx
jmp 0x965199
movzx eax, ax
cwde
cdq
push ebx
sub eax, edx
push ebp
sar eax, 1
xor ecx, ecx
push esi
push edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], ecx
test eax, eax
jle 0x965277
xor ebx, ebx
mov dword [esp + 0x30], ebx
jmp 0x9651c0
cmp ebx, ecx
jg 0x965265
mov eax, ebx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
mov eax, ecx
movsx ecx, word [esp + 0x1a]
sub eax, esi
movsx esi, word [esp + 0x18]
lea edi, [ecx + eax]
sub ecx, eax
movsx eax, word [esp + 0x20]
imul eax, edi
add esi, ebx
add eax, esi
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x24]
cmp word [eax + edx*4], 1
mov ebp, ecx
je 0x96521c
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x30]
mov word [esp + 0x20], si
mov word [esp + 0x22], di
call fcn.00964a70
test al, al
jne 0x965296
movsx eax, word [esp + 0x20]
imul eax, ebp
add eax, esi
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x24]
cmp word [eax + edx*4], 1
je 0x965250
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
mov word [esp + 0x2c], si
mov word [esp + 0x2e], bp
call fcn.00964a70
test al, al
jne 0x9652be
mov ecx, dword [esp + 0x10]
inc ebx
cmp ebx, ecx
jle 0x9651c8
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
inc ecx
dec ebx
cmp ecx, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], ebx
jl 0x9651c0
mov eax, dword [esp + 0x40]
mov cx, word [esp + 0x14]
mov dx, word [esp + 0x16]
pop edi
pop esi
pop ebp
mov word [eax], cx
mov word [eax + 2], dx
pop ebx
add esp, 0x2c
ret 4
lea edx, [esp + 0x30]
mov word [esp + 0x30], si
mov esi, dword [esp + 0x40]
push edx
push esi
mov word [esp + 0x3a], di
call fcn.0062f550
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
lea eax, [esp + 0x30]
mov word [esp + 0x30], si
mov esi, dword [esp + 0x40]
push eax
push esi
mov word [esp + 0x3a], bp
call fcn.0062f550
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x971a77
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
movzx ecx, word [esi + 8]
add cx, word [eax]
mov edx, 0xff
sub cx, dx
mov word [esp + 4], cx
movzx ecx, word [eax + 2]
add cx, word [esi + 0xa]
sub cx, dx
mov word [esp + 6], cx
movzx ecx, word [eax + 4]
add cx, word [esi + 0xc]
mov ax, word [eax + 6]
add ax, word [esi + 0xe]
sub cx, dx
mov word [esp + 8], cx
mov ecx, edx
sub ax, cx
mov word [esp + 0xa], ax
mov eax, dword [esp + 0x10]
cmp byte [eax + 0x4c], 0
je 0x971ada
cmp byte [eax + 0x4d], 0
je 0x971ada
lea ecx, [eax + 0x28]
call fcn.00568840
jmp 0x971adc
xor eax, eax
mov ecx, dword [esi + 0x14]
add ecx, dword [esp + 0x18]
lea edx, [esp + 4]
push edx
mov edx, dword [esi + 0x10]
add edx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
sub esp, 8
mov dword [esp + 0x28], edx
fstp dword [esp + 4]
fild dword [esp + 0x28]
fstp dword [esp]
push eax
call fcn.009718b0
add esp, 0x10
pop esi
add esp, 8
ret 0x14

Function at 0x979600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xa6d6b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
cmp dword [esi + 0x30], 0
mov dword [esp + 0x14], 0
je 0x97963b
call fcn.00979380
mov ecx, esi
mov dword [0xdbb380], 0
call fcn.006fcad0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x97a400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x97a40f
mov ecx, dword [eax + 4]
jmp 0x97a412
lea ecx, [eax + 4]
mov edx, dword [eax + 0x14]
add edx, ecx
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x97a432
push esi
movsx esi, byte [ecx]
imul eax, eax, 0x1000193
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x97a421
pop esi
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.00a3292f
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x97a45c
add eax, 0x7fffffff
ret 4
Function at 0x980950
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x1c], 0
lea ebx, [edi + 0x1c]
mov dword [esp + 0xc], 0
jne 0x98096e
mov ecx, ebx
call fcn.00980590
mov esi, dword [ebx]
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
mov ebx, 1
mov byte [esi + 4], bl
movzx ecx, word [eax + 4]
mov word [esi + 9], cx
movzx edx, word [eax + 6]
mov word [esi + 0xb], dx
movzx ecx, word [eax + 8]
mov word [esi + 0xd], cx
movzx edx, word [eax + 0xa]
mov word [esi + 0xf], dx
mov cl, byte [eax + 0xc]
mov byte [esi + 0x11], cl
mov edx, dword [eax + 0xd]
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x12], edx
mov ecx, dword [eax]
push esi
mov dword [esi + 0x18], ecx
push eax
mov ecx, edi
call fcn.004aa8a0
mov edx, dword [edi + 0x4c]
lea eax, [edi + 0x2c]
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], edx
mov eax, edx
mov dword [eax + 0x24], esi
mov ecx, dword [esi + 0x24]
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x20], esi
add dword [edi + 0x7c], ebx
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], vtable.phListSpace::_phListIterator_struct_EffFrameInfo__int__struct_IntHashGen_.0
pop ebx
pop ecx
ret 0xc
Function at 0x9827f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xa741fd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x34]
mov dword [esi], vtable.Cake.0
call fcn.00982400
xor ebx, ebx
lea ecx, [esi + 0x5c]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov edi, 8
push 1
mov dword [esp + 0x20], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 8], edi
call fcn.00981ed0
lea ecx, [esi + 0x70]
push 1
mov byte [esp + 0x20], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 8], edi
call fcn.00981ed0
lea ecx, [esi + 0x84]
push 1
mov byte [esp + 0x20], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 8], edi
call fcn.00981ed0
lea edi, [esi + 0x98]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi], vtable.RefT_class_Actor_.0
mov dword [edi + 0x14], ebx
fldz
mov byte [esi + 0x1c], bl
fst dword [esi + 0x14]
fst dword [esi + 0x10]
mov byte [esp + 0x1c], 4
fst dword [esi + 0xc]
fld1
fstp dword [esi + 0x18]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
fst dword [esi + 0x4c]
mov dword [esi + 0x30], ebx
fst dword [esi + 0x3c]
mov byte [esi + 0x51], 1
mov byte [esi + 0x52], bl
cmp dword [edi + 0x14], ebx
je 0x98290a
mov ecx, dword [edi + 4]
cmp ecx, ebx
je 0x9828f0
mov eax, dword [ecx]
fstp st(0)
mov edx, dword [eax + 8]
push ebx
push edi
call edx
fldz
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x982907
push edi
fstp st(0)
lea ecx, [eax + 0x24]
call fcn.00625840
fldz
mov dword [edi + 0x14], ebx
mov dword [edi + 0x14], ebx
xor eax, eax
mov word [esi + 0xb2], ax
xor ecx, ecx
mov word [esi + 0xb0], cx
fst dword [esi + 0xb8]
fstp dword [esi + 0x48]
mov dword [esi + 0x58], ebx
mov dword [esi + 0xb4], ebx
mov byte [esi + 0x54], bl
mov byte [esi + 0x50], bl
mov dword [esi + 0xbc], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov byte [esi + 0x53], bl
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xc8], bl
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret