joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411f30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x411f5d
push esi
call fcn.00419982
cmp byte [esi + 0x40], 0
pop ecx
je 0x411f56
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x411fcc
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x411fc1
mov eax, dword [esi + 8]
test eax, eax
je 0x411f7e
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x411fbd
cmp eax, 2
je 0x411fc1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x411f73
cmp eax, 3
je 0x411fa2
cmp eax, 1
jne 0x411f73
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x411f73
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x411f73
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x411fea
cmp eax, 0xcc
je 0x411fea
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.00411e03
pop esi
ret

Function at 0x41b28c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x41b29a
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x41b36e
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c1030]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c1030]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c1030]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c1030]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c1030]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c1030]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c1030]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c1030]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x41b2b7
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x41b38e
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x4c1030]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x41b374
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x42e950
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x4eac74]
xor eax, esp
mov dword [esp + 0x400], eax
lea eax, [esp + 0x40c]
push eax
push 0
push dword [esp + 0x410]
lea eax, [esp + 0xc]
push 0x400
push eax
call fcn.0042e910
add esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004958e0
add esp, 0x404
ret
Function at 0x430c40
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
mov edi, ecx
push ebx
call fcn.004986b0
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x430c75
mov eax, ecx
cdq
idiv dword [edi + 0x100]
mov al, byte [edx + edi]
xor byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jl 0x430c61
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x430e60
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
push edi
call fcn.00495b2f
push edi
push dword [esp + 0x18]
mov esi, eax
push esi
call fcn.004986b0
add esp, 0x10
xor ecx, ecx
test edi, edi
jle 0x430e9c
mov eax, ecx
cdq
idiv dword [0x501130]
mov al, byte [edx + 0x501030]
xor byte [ecx + esi], al
inc ecx
cmp ecx, edi
jl 0x430e85
push 0
push edi
push esi
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x430ec6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 1
push esi
call fcn.00495b21
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
ret 8
push 1
push esi
call fcn.00495b21
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
ret 8
Function at 0x4327f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x43281b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x43283d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x43283f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x4328c3
jg 0x432854
test esi, esi
je 0x4328c3
test ecx, ecx
jl 0x43289d
jg 0x43285e
test eax, eax
je 0x43289d
cmp edi, ecx
jg 0x432872
jl 0x432868
cmp esi, eax
jae 0x432872
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004986b0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4328a0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4328c3
jg 0x4328aa
test esi, esi
je 0x4328c3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4328c3
push eax
push esi
push 1
push edx
call fcn.004a45ed
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4328e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x43290b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004332e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x43292d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x43292f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4329ce
jg 0x43294c
test esi, esi
je 0x4329ce
test ecx, ecx
jl 0x432999
jg 0x432956
test eax, eax
je 0x432999
cmp ebx, ecx
jg 0x43296a
jl 0x432960
cmp esi, eax
jae 0x43296a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.004986b0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4329a0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4329ce
jg 0x4329aa
test esi, esi
je 0x4329ce
cmp dword [edi + 0x4c], 0
je 0x4329ce
mov ecx, edi
call fcn.00433870
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004a4bc7
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432dd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x4eac74]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x432e00
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004958e0
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x432e3d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x432e3d
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004958e0
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x432f1b
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x432e65
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x432e99
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004a3f45
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004958e0
add esp, 0x30
ret 4
mov al, bl
mov byte [esp + 0xf], al
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x432f32
lea ecx, [esp + 0xf]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], ecx
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.004a3f45
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004958e0
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x432f09
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a45ed
add esp, 0x10
cmp edi, eax
jne 0x432f1b
lea eax, [esp + 0xf]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
jne 0x432e27
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004958e0
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x432f1b
cmp eax, 1
jle 0x432eea
cmp eax, 3
jne 0x432f1b
mov al, byte [esp + 0xf]
jmp 0x432ebd
Function at 0x4338a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4eac74]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x43393e
cmp byte [esi + 0x3d], 0
je 0x43393e
push 0xffffffffffffffff
call fcn.00432dd0
cmp eax, 0xffffffff
je 0x4338f4
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x433951
lea edi, [esp + 0xc]
xor eax, eax
mov dword [esp + 8], edi
sub eax, 0
je 0x433907
sub eax, 1
je 0x43390b
sub eax, 2
je 0x43393e
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004958e0
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
lea eax, [esp + 0xc]
sub edi, eax
je 0x433926
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a45ed
add esp, 0x10
cmp edi, eax
jne 0x4338f4
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004958e0
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.004958e0
add esp, 0x28
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
mov edi, dword [esp + 8]
jmp 0x4338e5
Function at 0x4349c0
Capabilities:
Get mac address on windows
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baa38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4eac74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push 0x100
mov ecx, eax
call fcn.00434bc0
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x10]
push eax
push 0
mov dword [ebp - 0x10], 0
call esi
push dword [ebp - 0x10]
call fcn.00495b2f
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
call esi
mov esi, ebx
test ebx, ebx
je 0x434aa5
cmp dword [esi + 0x1a0], 6
jne 0x434a9f
cmp dword [esi + 0x190], 6
jne 0x434a9f
movzx eax, byte [esi + 0x199]
mov ecx, dword [ebp - 0x24]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
mov eax, dword [ebp - 0x20]
push str._02X__02X__02X__02X__02X__02X
sub eax, ecx
push eax
push ecx
call fcn.0042e9f0
add esp, 0x24
mov esi, dword [esi]
test esi, esi
jne 0x434a46
mov edi, dword [ebp - 0x24]
or ebx, 0xffffffff
mov ecx, edi
xor edx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434ab2
sub ecx, esi
je 0x434aed
nop dword [eax]
movzx ecx, byte [edi + edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
mov eax, edi
xor ebx, dword [ecx*4 + 0x4d1d00]
inc edx
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434ae0
sub eax, esi
cmp edx, eax
jb 0x434ac0
push dword [ebp - 0x14]
call fcn.00495aec
mov ecx, dword [ebp - 0x24]
add esp, 4
test ecx, ecx
je 0x434b28
mov edx, dword [ebp - 0x1c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x434b1e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434b3c
push edx
push ecx
call fcn.00495b21
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a3b00
int3
Function at 0x438780
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
xor edx, edx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
setne dl
mov edi, ecx
xor eax, eax
lea edx, [edx*2 - 1]
add edx, dword [0x50162c]
mov dword [0x50162c], edx
sete al
test esi, esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [edi + 0x2a38c], eax
je 0x4388ae
cmp edx, 1
jne 0x4388ae
cmp dword [edi + 0x2a390], 0
je 0x4388ae
cmp dword [0x501658], 0
jne 0x438815
lea eax, [esp + 8]
mov dword [0x501658], edx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x501668], edx
test edx, edx
je 0x43886a
mov ecx, dword [esp + 8]
mov dword [0x501630], ecx
mov ecx, dword [esp + 0xc]
mov dword [0x501634], ecx
jmp 0x43881b
mov edx, dword [0x501668]
test edx, edx
je 0x43886a
mov ecx, dword [0x501648]
mov eax, ecx
mov esi, dword [0x50164c]
or eax, esi
jne 0x43884a
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [0x501668]
mov dword [0x50164c], esi
mov dword [0x501664], esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x501648], ecx
mov dword [0x501660], ecx
jmp 0x4388b4
movsd xmm0, qword [0x501670]
ucomisd xmm0, qword [0x4dfdf0]
lahf
test ah, 0x44
jp 0x4388a4
call esi
mov edx, dword [0x501668]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4e0250]
mulsd xmm0, qword [0x4dfec8]
movsd qword [0x501670], xmm0
jmp 0x4388b4
mov edx, dword [0x501668]
cmp dword [0x50162c], 0
jne 0x4389a8
cmp dword [edi + 0x2a390], 0
je 0x4389a8
cmp dword [0x501658], 0
jne 0x43890a
lea eax, [esp + 8]
mov dword [0x501658], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x501668], edx
test edx, edx
je 0x43895c
mov eax, dword [esp + 8]
mov dword [0x501630], eax
mov eax, dword [esp + 0xc]
mov dword [0x501634], eax
test edx, edx
je 0x43895c
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 8]
xorps xmm0, xmm0
mov edx, dword [esp + 0xc]
mov ecx, esi
sub ecx, dword [0x501648]
mov eax, edx
mov dword [0x501660], esi
sbb eax, dword [0x50164c]
add dword [0x501640], ecx
movlpd qword [0x501648], xmm0
adc dword [0x501644], eax
mov dword [0x501664], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call esi
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x4e0250]
mulsd xmm1, qword [0x4dfec8]
movaps xmm0, xmm1
movsd qword [0x501638], xmm1
subsd xmm0, qword [0x501670]
addsd xmm0, qword [0x501650]
movsd qword [0x501650], xmm0
xorps xmm0, xmm0
movsd qword [0x501670], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46b9a0
Capabilities:
Read file on windows

Disassembly:
cmp dword [0x4ffd58], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x46b9da
push 0x4d1cc4
push 0x4d1cc8
call fcn.004a3c4f
mov edi, eax
add esp, 8
test edi, edi
je 0x46b9da
push str.GroundObjectTiles::Generate
push edi
call fcn.00430f00
push edi
call fcn.004a3d23
add esp, 0xc
call fcn.004a3b50
push 0x1c0000
mov dword [esi + 0x108], 0x100
mov dword [esi + 0x10c], 0x100
call fcn.00495b2f
mov ecx, dword [esi + 0x10c]
add esp, 4
xor ebx, ebx
mov dword [esi + 0x120], eax
test ecx, ecx
jle 0x46bae5
mov eax, dword [esi + 0x108]
xor edx, edx
test eax, eax
jle 0x46bad4
nop word [eax + eax]
xor edi, edi
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 1], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 2], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 3], 0
add edi, 4
cmp edi, 0x1c
jl 0x46ba32
mov eax, dword [esi + 0x108]
inc edx
cmp edx, eax
jl 0x46ba30
mov ecx, dword [esi + 0x10c]
inc ebx
cmp ebx, ecx
jl 0x46ba16
jmp 0x46baeb
mov eax, dword [esi + 0x108]
imul eax, ecx
push eax
call fcn.00495b2f
mov dword [esi + 0x194], eax
add esp, 4
mov eax, dword [esi + 0x110]
test eax, eax
jne 0x46bb13
push 0x4d6bc8
push str.dat_roads_256.raw
jmp 0x46bb22
cmp eax, 1
jne 0x46bb4e
push 0x4d6bec
push str.dat_roads2_256.raw
call fcn.004a3c4f
mov ecx, dword [esi + 0x108]
mov edi, eax
imul ecx, dword [esi + 0x10c]
push edi
push ecx
push 1
push dword [esi + 0x194]
call fcn.004a4bc7
push edi
call fcn.004a3d23
add esp, 0x1c
cmp dword [0x4ffd58], 0
je 0x46bb83
push 0x4d1cc4
push 0x4d1cc8
call fcn.004a3c4f
mov esi, eax
add esp, 8
test esi, esi
je 0x46bb83
push 0x4d6c04
push esi
call fcn.00430f00
push esi
call fcn.004a3d23
add esp, 0xc
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x47f1f0
Capabilities:
Check http status code

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x500c84]
push edi
call fcn.00443ef0
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp edi, 0xc8
mov byte [esp + 0x1c], 0x13
setne bl
lea ebx, [ebx*2 + 1]
cmp edi, 0xc9
jne 0x47f22e
mov ebx, 2
jmp 0x47f23c
cmp edi, 0xcb
mov eax, 4
cmove ebx, eax
mov ecx, dword [esi + 0x2b8]
push 0x19
add ecx, 0x140
call fcn.00434ee0
test eax, eax
jne 0x47f320
cmp edi, 0xc8
jne 0x47f2b0
mov ecx, dword [esi + 0x2c0]
push 0x87
add ecx, 0x140
call fcn.00434ee0
test eax, eax
jne 0x47f2b0
mov ecx, dword [0x4ffd78]
lea edx, [esp + 0x14]
push 0
push 0
push edx
mov eax, dword [ecx]
push 5
mov byte [esp + 0x24], 0x40
call dword [eax + 4]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ebp, dword [esi + 0x2b8]
mov ecx, dword [esi + 0x2c0]
mov dword [esp + 0x2c], ecx
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
cmp eax, method.UIRectArtTextButton.virtual_20
jne 0x47f465
cmp dword [ebp + 0x14c], 0
je 0x47f2ec
mov eax, dword [ebp + 0x144]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0
sete al
jmp 0x47f2ee
mov al, 1
mov byte [ecx + 0x139], al
push ecx
lea ecx, [ebp + 0x140]
call fcn.00434e20
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x13c], ebp
mov ecx, dword [esi + 0x2b8]
jmp 0x47f3be
mov ecx, dword [esi + 0x2b8]
jmp 0x47f3be
mov ecx, dword [esi + 0x2c0]
add ecx, 0x140
cmp edi, dword [esi + 0x23bc]
je 0x47f3f7
push 0x87
call fcn.00434ee0
cmp edi, 0xc8
je 0x47f3a3
test eax, eax
je 0x47f3c3
mov ecx, dword [esi + 0x2b8]
push 0x86
add ecx, 0x140
call fcn.00434ee0
test eax, eax
je 0x47f38a
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.00434f30
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
add ecx, 0x140
call fcn.00434f30
jmp 0x47f3b8
test eax, eax
jne 0x47f3c3
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [0x4ffd78]
lea edx, [esp + 0x1c]
mov eax, dword [esi + 0x23a4]
push 0
push 0
mov byte [esp + 0x29], bl
mov dword [esp + 0x25], eax
mov eax, dword [ecx]
push edx
push 0xa
call dword [eax + 4]
mov dword [esi + 0x23bc], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push dword [esi + 0x2fc]
call fcn.00434f30
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c0]
add ecx, 0x140
call fcn.00434f30
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.00434f30
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
pop edi
mov dword [esi + 0x23bc], 0
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push ecx
mov ecx, ebp
call eax
jmp 0x47f315
Function at 0x4ad303
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ad182
Function at 0x10001000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
sub esp, 0x14
push ebx
push esi
push edi
jmp 0x100010b9
mov esi, dword [ecx + 0x3c]
mov edx, dword [eax + 0x2c]
mov esi, dword [esi + ecx + 0x78]
and dword [ebp - 8], 0
mov edi, dword [eax + 0x30]
mov eax, dword [eax]
mov dword [ebp - 0x14], edx
test esi, esi
je 0x100010b9
and dword [ebp - 4], 0
shr edx, 0x10
xor ebx, ebx
cmp bx, dx
jae 0x10001073
mov edx, dword [ebp - 4]
mov dl, byte [edi + edx]
ror dword [ebp - 8], 0xd
cmp dl, 0x61
movsx edx, dl
jl 0x10001064
mov ebx, dword [ebp - 8]
lea edx, [ebx + edx - 0x20]
mov dword [ebp - 8], edx
jmp 0x10001067
add dword [ebp - 8], edx
movzx edx, word [ebp - 0x12]
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jb 0x10001046
and dword [ebp - 4], 0
add esi, ecx
mov edx, dword [esi + 0x20]
mov edi, dword [esi + 0x18]
add edx, ecx
test edi, edi
je 0x100010b9
mov edi, dword [edx]
add edi, ecx
xor ebx, ebx
add edx, 4
mov dword [ebp - 0xc], edi
movsx edi, byte [edi]
ror ebx, 0xd
add ebx, edi
mov edi, dword [ebp - 0xc]
inc edi
cmp byte [edi - 1], 0
mov dword [ebp - 0xc], edi
jne 0x10001091
add ebx, dword [ebp - 8]
cmp ebx, dword [ebp + 8]
je 0x100010cb
inc dword [ebp - 4]
mov edi, dword [ebp - 4]
cmp edi, dword [esi + 0x18]
jb 0x10001085
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x1000101a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x24]
lea eax, [eax + edx*2]
movzx eax, word [eax + ecx]
mov edx, dword [esi + 0x1c]
lea eax, [edx + eax*4]
mov eax, dword [eax + ecx]
add eax, ecx
jmp 0x100010c6