joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dbe43
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
push 0
call fcn.00463870
push 0x1c
call fcn.004b8b2d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x38], 0
je 0x46a161
mov ecx, eax
call fcn.0042fe20
jmp 0x46a163
xor eax, eax
push 1
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], 0xffffffff
call fcn.0042e260
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 1
call fcn.004438c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
call eax
push 0
lea ecx, [esp + 0x20]
call fcn.004438c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push 0
call eax
push 0
lea ecx, [esp + 0x20]
call fcn.004438c0
mov edx, dword [eax]
mov esi, dword [esp + 0x40]
mov ecx, eax
mov eax, dword [edx + 0x68]
push esi
call eax
cmp eax, 1
jne 0x46a1f7
push 0x4f2358
lea ecx, [esp + 0x44]
call fcn.00401db0
push esi
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 2
call fcn.00406270
push 0x51dde4
lea edx, [esp + 0x14]
push edx
call fcn.004b7fa0
push 0
lea ecx, [esp + 0x20]
call fcn.004438c0
push eax
mov ecx, 0x557fd0
call fcn.0045ddd0
mov eax, dword [0x557ff4]
test eax, eax
mov esi, dword [0x557fec]
je 0x46a21e
mov esi, eax
lea eax, [esp + 0x40]
push eax
mov ecx, 0x557fd0
call fcn.0045a720
push esi
push eax
mov ecx, edi
mov byte [esp + 0x40], 3
call fcn.004690a0
mov eax, dword [esp + 0x40]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x531020]
mov byte [esp + 0x38], 1
je 0x46a26d
add eax, 0xfffffff4
push eax
call dword [0x4ed26c]
test eax, eax
jg 0x46a26d
mov eax, dword [esp + 0x40]
add eax, 0xfffffff4
push eax
call fcn.004b7e1e
add esp, 4
mov ecx, edi
mov dword [edi + 4], 1
call fcn.0041f530
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0042c700
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x46dc90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dc509
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x24]
mov dword [esi], vtable.CMidiSoundDM.0
mov dword [esi + 4], eax
mov dword [esi + 8], vtable.CFileCtl.0
xor ebp, ebp
mov dword [esi + 0xc], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_IFile_.0
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov ecx, dword [0x531024]
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x20], ecx
lea edi, [esi + 0x3c]
mov dword [edi], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_CSoundFade_.0
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], ebp
push 0x18
mov byte [esp + 0x20], 2
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x38], ebp
call fcn.004b8b2d
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebp
mov byte [esp + 0x1c], 3
je 0x46dd3d
push esi
mov ecx, eax
call fcn.00472130
jmp 0x46dd3f
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x20], 2
call fcn.0046dbc0
push ebp
mov ecx, edi
call fcn.004438c0
mov dword [eax + 0x10], 0xffffd8f0
mov dword [eax + 0x14], 0x3e8
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4

Function at 0x46e180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dc5fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor eax, eax
lea edi, [esi + 4]
mov dword [esp + 0x18], eax
mov dword [edi], vtable.IWinHook.0
mov dword [esi], vtable.CMidiSoundMCI.1.0
mov dword [edi], vtable.CMidiSoundMCI.0
mov dword [esi + 8], vtable.CFileCtl.0
mov dword [esi + 0xc], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_IFile_.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov ecx, dword [0x531024]
mov dword [esi + 0x20], ecx
mov ecx, 0x555368
mov byte [esp + 0x18], 2
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x34], eax
call fcn.00407160
mov ecx, dword [0x555364]
push edi
call fcn.004021e0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x471d50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4dd11e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CSoundFactory.0
xor eax, eax
mov dword [esi + 4], vtable.yaneuraoGameSDK3rd::YTL::ref_creater_class_CDirectSound_.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esi + 0x10], vtable.yaneuraoGameSDK3rd::YTL::ref_creater_and_mediator_class_CDirectMusic__class_CDirectSound_.0
push eax
push esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.00471af0
push eax
mov ecx, 0x53812c
mov byte [esp + 0x2c], 2
call fcn.0040f790
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.00470e10
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x472d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dd440
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
je 0x472de2
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00472660
push 0
mov ecx, eax
mov dword [esp + 0x3c], 0
call fcn.004438c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x14]
call eax
test eax, eax
lea ecx, [esp + 0x1c]
setl bl
mov dword [esp + 0x38], 0xffffffff
call fcn.004724e0
test bl, bl
je 0x472de2
push str.CWaveSoundStatic::Release_GetBuffer____Stop__
lea ecx, [esp + 0x14]
call fcn.00401db0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 1
call fcn.0046cc40
push 0x52a770
lea ecx, [esp + 0x18]
push ecx
call fcn.004b7fa0
lea edi, [esi + 0x40]
push 0
mov ecx, edi
call fcn.004438c0
push 0
mov ecx, edi
mov dword [eax + 4], 1
call fcn.004438c0
mov ecx, eax
call fcn.004721e0
lea ecx, [esi + 0xc]
call fcn.004125b0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x473710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dd64a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x24], edi
mov dword [ebx], vtable.IWinHook.0
mov dword [esi], vtable.CWaveSoundStatic.1.0
mov dword [ebx], vtable.CWaveSoundStatic.0
mov eax, dword [0x531024]
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_ISoundBuffer_.0
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_ISoundStream_.0
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
lea ebp, [esi + 0x40]
mov dword [ebp], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_CSoundFade_.0
mov dword [ebp + 4], edi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x10], edi
push 4
mov byte [esp + 0x28], 5
call fcn.004b8b2d
add esp, 4
cmp eax, edi
je 0x4737ba
mov dword [eax], vtable.CNullSoundBuffer.0
jmp 0x4737bc
xor eax, eax
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
push 1
push eax
call fcn.00472e30
mov ecx, esi
call fcn.004726a0
push 0x18
mov dword [esi + 0x10], edi
mov dword [esi + 0x54], edi
call fcn.004b8b2d
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, edi
mov byte [esp + 0x24], 6
je 0x4737fb
push esi
mov ecx, eax
call fcn.00472130
jmp 0x4737fd
xor eax, eax
push eax
mov ecx, ebp
mov byte [esp + 0x28], 5
call fcn.0046dbc0
push edi
mov ecx, ebp
call fcn.004438c0
mov ecx, 0x555368
mov dword [eax + 0x10], 0xffffd8f0
mov dword [eax + 0x14], edi
call fcn.00407160
mov ecx, dword [0x555364]
push ebx
call fcn.004021e0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x47c730
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4de2c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x10]
call fcn.00403df0
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00403f20
test eax, eax
jne 0x47c7ce
push 0xab8
call fcn.004b7d96
mov ecx, dword [esp + 0x18]
push ecx
push 1
mov ebx, eax
push 0xab8
push ebx
call fcn.004b9102
mov ecx, 0x2ae
mov esi, ebx
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004b7e1e
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.00403b90
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4
lea ecx, [esp + 0x10]
call fcn.00403b90
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4

Function at 0x47cac0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4de360
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push str.arc_tblstr.arc
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x28], 1
call fcn.004061f0
push eax
mov ecx, 0x557f94
mov byte [esp + 0x20], 2
call fcn.00403f20
mov esi, dword [0x4ed26c]
test eax, eax
mov eax, dword [esp + 0xc]
lea edx, [eax - 0xc]
setne bl
cmp edx, dword [0x531020]
mov byte [esp + 0x1c], 1
je 0x47cb4a
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x47cb4a
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.004b7e1e
add esp, 4
test bl, bl
je 0x47cb65
push 0x525af0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x4f3c34
call fcn.004b7fa0
push str.arc_tblstr.ari
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004061f0
push eax
mov ecx, 0x557fa0
mov byte [esp + 0x20], 3
call fcn.00403f20
test eax, eax
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
setne bl
cmp ecx, dword [0x531020]
mov byte [esp + 0x1c], 1
je 0x47cbbc
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x47cbbc
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.004b7e1e
add esp, 4
test bl, bl
je 0x47cbd7
push 0x525af0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x4f3be4
call fcn.004b7fa0
mov eax, dword [0x557fa4]
push eax
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.004b9102
mov edx, dword [esp + 0x20]
add esp, 0x10
push edx
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str.readfg.idx
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.004061f0
mov ecx, 0x537a98
call fcn.0047c7f0
test eax, eax
jne 0x47cc2f
push 0x525af0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x4f3ba8
call fcn.004b7fa0
lea ecx, [esp + 0x24]
call fcn.0041b6b0
lea ecx, [esp + 0x28]
call fcn.0041b6b0
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4826f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4deeb8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x553abc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov ecx, 0x555368
mov dword [ebp - 0x68], 0x2c
call fcn.00407160
mov eax, dword [0x555364]
mov eax, dword [eax]
lea ecx, [ebp - 0x68]
push ecx
push eax
call dword [0x4ed2f0]
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [0x4ed29c]
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
mov ecx, 0x555368
call fcn.00407160
mov eax, dword [0x555364]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
add eax, 0x40
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edx
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
mov dword [ebp - 4], 0
call edx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4869d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4df8b8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0xc], vtable.CSettingDlg.0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov ecx, 0x5553f0
mov dword [esp + 0x58], esi
call fcn.00408360
mov eax, dword [0x5553ec]
mov ecx, dword [eax]
mov dword [esp + 0x40], ecx
mov ecx, 0x5553f0
call fcn.00408360
mov edx, dword [0x5553ec]
mov eax, dword [edx + 0x138]
mov ecx, 0x5553f0
mov dword [esp + 0x44], eax
call fcn.00408360
mov ecx, dword [0x5553ec]
mov edx, dword [ecx + 0x130]
mov ecx, 0x5553f0
mov dword [esp + 0x48], edx
call fcn.00408360
mov eax, dword [0x5553ec]
mov ecx, dword [eax + 0x140]
push esi
mov dword [esp + 0x50], ecx
call dword [0x4ed3b4]
push eax
lea ecx, [esp + 0x14]
call fcn.0047b060
cmp eax, 1
jne 0x486b33
mov edi, dword [esp + 0x40]
mov ecx, 0x5553f0
call fcn.00408360
mov edx, dword [0x5553ec]
mov dword [edx], edi
mov edi, dword [esp + 0x44]
mov ecx, 0x5553f0
call fcn.00408360
mov eax, dword [0x5553ec]
mov dword [eax + 0x138], edi
mov edi, dword [esp + 0x48]
mov ecx, 0x5553f0
call fcn.00408360
mov ecx, dword [0x5553ec]
mov dword [ecx + 0x130], edi
mov edi, dword [esp + 0x4c]
mov ecx, 0x5553f0
call fcn.00408360
mov edx, dword [0x5553ec]
mov dword [edx + 0x140], edi
mov eax, dword [esp + 0x20]
cmp eax, esi
mov dword [esp + 0x58], 0xffffffff
je 0x486b1c
push eax
call fcn.0048b90d
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x50
ret
cmp eax, 2
jne 0x486b9f
mov edi, dword [esp + 0x40]
mov ecx, 0x5553f0
call fcn.00408360
mov eax, dword [0x5553ec]
mov dword [eax], edi
mov edi, dword [esp + 0x44]
mov ecx, 0x5553f0
call fcn.00408360
mov ecx, dword [0x5553ec]
mov dword [ecx + 0x138], edi
mov edi, dword [esp + 0x48]
mov ecx, 0x5553f0
call fcn.00408360
mov edx, dword [0x5553ec]
mov dword [edx + 0x130], edi
mov edi, dword [esp + 0x4c]
mov ecx, 0x5553f0
call fcn.00408360
mov eax, dword [0x5553ec]
mov dword [eax + 0x140], edi
call fcn.00486410
mov eax, dword [esp + 0x20]
cmp eax, esi
mov dword [esp + 0x58], 0xffffffff
je 0x486bb5
push eax
call fcn.0048b90d
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x50
ret
Function at 0x4870d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4df980
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CDrawBase.0
call fcn.00482bb0
xor edi, edi
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.0044f360
lea ecx, [esi + 0xfc]
mov byte [esp + 0x18], 1
call fcn.004502b0
mov dword [esi + 0x1f8], edi
mov dword [esi + method.yaneuraoGameSDK3rd::YTL::smart_ptr_class_CIntervalTimer_.virtual_0], vtable.yaneuraoGameSDK3rd::YTL::smart_ptr_class_CSceneMgr_.0
mov dword [esi + 0x204], edi
mov dword [esi + 0x208], edi
mov dword [esi + 0x20c], edi
mov dword [esi + 0x210], edi
lea ecx, [esi + 0x214]
mov byte [esp + 0x18], 3
call fcn.0045b700
mov dword [esi + 0x354], edi
mov dword [esi + 0x358], edi
mov dword [esi + 0x35c], edi
mov dword [esi + 0x360], edi
mov ecx, 0x555368
mov byte [esp + 0x18], 4
mov dword [esi + 0x364], edi
mov dword [esi + 0x368], edi
mov dword [esi + 0x36c], edi
mov dword [esi + 0x370], edi
call fcn.00407160
mov eax, dword [0x555364]
mov dword [eax + 0xdc], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x487ef0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4dfaeb
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x553abc]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov ecx, 0x555368
call fcn.00407160
mov eax, dword [0x555364]
mov esi, dword [eax + 4]
lea ecx, [esp + 0x1c]
xor ebx, ebx
push ecx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [0x4ed2a0]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov ecx, 0x555368
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
call fcn.00407160
mov eax, dword [0x555364]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
add eax, 0x30
mov dword [eax], edi
mov dword [eax + 4], ebp
mov dword [eax + 8], ecx
push 0x18
mov dword [eax + 0xc], edx
call fcn.004b8b2d
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
cmp edi, ebx
mov dword [esp + 0x44], ebx
je 0x487fbf
mov ecx, 0x5553f0
call fcn.00408360
mov eax, dword [0x5553ec]
mov eax, dword [eax + 0x130]
push eax
mov ecx, edi
call fcn.00487c90
jmp 0x487fc1
xor eax, eax
mov edi, dword [esp + 0x14]
add edi, 0x24
push eax
mov ecx, edi
mov dword [esp + 0x48], 0xffffffff
call fcn.0047d4f0
push ebx
mov ecx, edi
call fcn.004438c0
mov ecx, 0x5553f0
mov edi, eax
call fcn.00408360
mov eax, dword [0x5553ec]
mov ecx, dword [eax]
mov edx, dword [edi]
mov edx, dword [edx + 4]
push 0x258
push 0x320
push ecx
push esi
mov ecx, edi
call edx
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x48c27e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x48c3a1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x48c385
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x48c2d7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x48c2b5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x49279d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x4927cb
test ecx, ecx
jne 0x4927d5
test esi, esi
jne 0x4927d5
mov eax, edx
jmp 0x492846
cmp eax, 0xffffffff
jne 0x4927d5
push 0xfffffffffffffffe
pop eax
jmp 0x492846
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x492846
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x49280b
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x49282a
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x4928f3
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x49286b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x492875
xor ecx, ecx
jmp 0x4928b4
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x492897
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.004a2c77
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x4928df
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x4928f3
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4927ad
pop edi
pop esi
leave
ret