joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4542c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f0c8
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x56617c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x1a0]
lea esi, [edi + 0x1a0]
mov ecx, esi
mov dword [ebp - 0x14], esi
call dword [eax + 4]
mov ebx, dword [ebp + 8]
mov eax, 0x2aaaaaab
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x64]
sub ecx, dword [edi + 0x60]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jge 0x454427
mov eax, dword [edi + 0x40]
cmp eax, 0xffffffff
je 0x454359
cmp dword [ebp + 0x10], 1
jne 0x454359
mov ecx, dword [edi + 0x60]
lea eax, [eax + eax*2]
cmp dword [ecx + eax*8 + 0x14], 0x10
lea edx, [ecx + eax*8]
jb 0x45434d
mov edx, dword [edx]
mov ecx, dword [edi + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0xf4]
mov dword [edi + 0x40], ebx
lea ecx, [ebx + ebx*2]
mov eax, dword [edi + 0x60]
cmp dword [eax + ecx*8 + 0x14], 0x10
lea edx, [eax + ecx*8]
jb 0x45436e
mov edx, dword [edx]
mov ecx, dword [edi + 0x10]
push 1
push edx
mov eax, dword [ecx]
call dword [eax + 0xec]
lea ecx, [ebp - 0x60]
call fcn.0041ad80
cmp dword [ebp - 0x28], 0
mov dword [ebp - 0x60], vtable.CStringUTF8.0
je 0x454399
lea ecx, [ebp - 0x2c]
call fcn.0041a760
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
push str.emote_update_sub_timeline._n
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.0041a9d0
lea eax, [ebp - 0xa8]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x60]
call fcn.0041a900
lea ecx, [ebp - 0xa8]
call fcn.0041c2a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x60]
call dword [eax + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0
call fcn.0041c2a0
call fcn.00426230
cmp eax, 2
je 0x454409
cmp dword [ebp + 0xc], 0
jne 0x454427
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x114]
mov ecx, dword [edi + 0x10]
push ecx
mov dword [esp], 0
mov eax, dword [ecx]
call dword [eax + 0x118]
mov dword [ebp - 4], 5
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe27d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x454460
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f128
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x56617c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x1a0]
lea esi, [edi + 0x1a0]
mov ecx, esi
mov dword [ebp - 0x14], esi
call dword [eax + 4]
mov ebx, dword [ebp + 8]
mov eax, 0x2aaaaaab
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x64]
sub ecx, dword [edi + 0x60]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jge 0x4545c1
mov eax, dword [edi + 0x44]
cmp eax, 0xffffffff
je 0x4544f3
mov ecx, dword [edi + 0x60]
lea eax, [eax + eax*2]
cmp dword [ecx + eax*8 + 0x14], 0x10
lea edx, [ecx + eax*8]
jb 0x4544e7
mov edx, dword [edx]
mov ecx, dword [edi + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0xf4]
mov dword [edi + 0x44], ebx
lea ecx, [ebx + ebx*2]
mov eax, dword [edi + 0x60]
cmp dword [eax + ecx*8 + 0x14], 0x10
lea edx, [eax + ecx*8]
jb 0x454508
mov edx, dword [edx]
mov ecx, dword [edi + 0x10]
push 1
push edx
mov eax, dword [ecx]
call dword [eax + 0xec]
lea ecx, [ebp - 0x60]
call fcn.0041ad80
cmp dword [ebp - 0x28], 0
mov dword [ebp - 0x60], vtable.CStringUTF8.0
je 0x454533
lea ecx, [ebp - 0x2c]
call fcn.0041a760
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
push str.emote_update_sub_timeline._n
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.0041a9d0
lea eax, [ebp - 0xa8]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x60]
call fcn.0041a900
lea ecx, [ebp - 0xa8]
call fcn.0041c2a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x60]
call dword [eax + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0
call fcn.0041c2a0
call fcn.00426230
cmp eax, 2
je 0x4545a3
cmp dword [ebp + 0xc], 0
jne 0x4545c1
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x114]
mov ecx, dword [edi + 0x10]
push ecx
mov dword [esp], 0
mov eax, dword [ecx]
call dword [eax + 0x118]
mov dword [ebp - 4], 5
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe27d
mov esp, ebp
pop ebp
ret 8
Function at 0x4547d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f1b5
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x56617c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x10], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x5c], ecx
je 0x454981
call fcn.0042a8c0
mov eax, dword [ebx + 0x1a0]
lea esi, [ebx + 0x1a0]
mov ecx, esi
mov dword [ebp - 0x14], esi
call dword [eax + 4]
mov dword [ebp - 4], 0
cmp dword [0x592ad4], 1
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
jne 0x454847
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x454849
call edi
sub eax, dword [0x57e834]
cmp dword [0x592ad4], 1
mov dword [0x57e830], eax
jne 0x454865
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x454867
call edi
mov ecx, dword [0x57e830]
mov dword [0x57e834], eax
cmp ecx, 0x11
jae 0x454885
mov eax, 0x10
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.005001b0
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.0041ad80
cmp dword [ebp - 0x20], 0
mov dword [ebp - 0x58], vtable.CStringUTF8.0
je 0x4548b2
lea ecx, [ebp - 0x24]
call fcn.0041a760
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa4]
push dword [0x57e830]
push str.e_mote_frame_time___d_n
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004e78b0
add esp, 0x10
lea ecx, [ebp - 0xa4]
call fcn.0041c2a0
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call dword [eax + 0x40]
call fcn.0042a8c0
mov eax, dword [0x593460]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x454952
lea edi, [eax + 0x130]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x60]
push dword [ecx + 0x194]
mov eax, dword [edx]
push dword [ecx + 0x190]
mov ecx, edx
call dword [eax + 0x34]
mov ecx, dword [0x593460]
push 1
push 0x7d0
push 0x7d0
mov eax, dword [ecx]
push 0
push 0
call dword [eax + 0x38]
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x454961
mov eax, dword [ecx]
call dword [eax + 0x120]
lea ecx, [ebp - 0x58]
mov dword [ebx + 0x1c4], 0
call fcn.0041c2a0
mov dword [ebp - 4], 2
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe27d
mov esp, ebp
pop ebp
ret 4
Function at 0x4694c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520920
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x56617c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
call fcn.0046ad90
mov ebx, eax
mov ecx, edi
push esi
mov dword [ebp - 0xe0], ebx
call fcn.0046af30
mov ecx, dword [edi]
lea edx, [edi + 0x1c]
push edx
mov ecx, dword [ecx + ebx*4]
call fcn.0046b000
mov eax, dword [edi]
push dword [edi + 0x10]
push dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
mov esi, dword [eax]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x30]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4695b5
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x38]
push 1
lea ecx, [ebp - 0xd8]
call fcn.004dbb30
mov dword [ebp - 4], 0
lea eax, [ebp - 0xd8]
or dword [ebp - 0xd8], 3
mov ecx, esi
push eax
mov byte [ebp - 0xc4], 1
mov dword [ebp - 0xcc], ebx
call fcn.004daee0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x94]
test ecx, ecx
je 0x4695b5
mov edx, dword [ebp - 0x8c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4695ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x469695
push edx
push ecx
call fcn.004fe28b
add esp, 8
mov eax, dword [ebp + 0x10]
cmp eax, 5
ja case.default.0x4695bd
jmp dword [eax*4 + 0x46969c]
push esi
mov ecx, edi
call fcn.00469730
jmp case.default.0x4695bd
push esi
mov ecx, edi
call fcn.00469af0
jmp case.default.0x4695bd
push ebx
push esi
mov ecx, edi
call fcn.00469eb0
jmp case.default.0x4695bd
push esi
mov ecx, edi
call fcn.0046a270
jmp case.default.0x4695bd
push esi
mov ecx, edi
call fcn.0046a640
jmp case.default.0x4695bd
push esi
mov ecx, edi
call fcn.0046a9c0
mov eax, dword [edi]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0xe4], eax
mov esi, dword [eax]
test esi, esi
je 0x469671
mov edi, dword [eax + 4]
xor ecx, ecx
mov dword [ebp - 0xdc], esi
mov ebx, dword [edi + 0x34]
mov edx, ebx
mov eax, dword [edi + 0x30]
sub edx, eax
sar edx, 2
test edx, edx
je 0x46963e
cmp dword [eax], esi
je 0x46965b
inc ecx
add eax, 4
cmp ecx, edx
jb 0x469632
cmp ebx, dword [edi + 0x38]
je 0x46964b
mov dword [ebx], esi
add dword [edi + 0x34], 4
jmp 0x46965b
lea eax, [ebp - 0xdc]
push eax
push ebx
lea ecx, [edi + 0x30]
call fcn.00424160
mov ecx, dword [ebp - 0xe4]
push 0
push 0
push 0
mov ecx, dword [ecx + 4]
push 0
call fcn.004dc140
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe27d
mov esp, ebp
pop ebp
ret 0xc
call fcn.00501acf
nop
les edx, [ebp - 0x6a31ffba]
inc esi
add al, bl
xchg ebp, eax
inc esi
add bl, ah
xchg ebp, eax
inc esi
add ch, ch
xchg ebp, eax
inc esi
add bh, dh
xchg ebp, eax
inc esi
add ah, cl
int3
Function at 0x479300
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5218d5
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x56617c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x592ad4], 1
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
jne 0x479344
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x479346
call edi
cmp dword [ebx + 0x1cc], eax
ja 0x479528
mov eax, dword [ebx + 0x1e4]
lea ecx, [ebx + 0x1e4]
call dword [eax + 0x48]
cmp dword [ebx + 0x1c8], eax
jne 0x479393
cmp dword [0x592ad4], 1
jne 0x47937b
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
jmp 0x47937d
call edi
add eax, 0x1f4
inc dword [ebx + 0x1c8]
mov dword [ebx + 0x1cc], eax
jmp 0x479528
mov eax, dword [ebx + 0x1e4]
lea ecx, [ebx + 0x1e4]
call dword [eax + 0x48]
mov edi, dword [ebx + 0x1c8]
cmp edi, eax
jle 0x4793e9
mov ecx, dword [ebx + 0x1e0]
push 0
add ecx, 0x130
push 0x20
push 0x10e
push 0x195
mov eax, dword [ecx]
push 0x85
call dword [eax + 0xe8]
mov dword [ebx + 0x1c8], 0
xor edi, edi
mov dword [ebx + 0x228], 0
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.005001b0
add esp, 0xc
lea eax, [ebp - 0x58]
lea ecx, [ebx + 0x1e4]
push edi
push eax
call fcn.004247e0
sub esp, 0x44
mov dword [ebp - 4], 0
mov esi, esp
mov ecx, esi
mov dword [ebp - 0x5c], esi
call fcn.0041ad80
cmp dword [esi + 0x38], 0
mov dword [esi], vtable.CStringUTF8.0
je 0x479433
lea ecx, [esi + 0x34]
call fcn.0041a760
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0041a900
mov byte [ebp - 4], 0
call fcn.004e7ad0
add esp, 0x44
mov edi, dword [ebx + 0x1e0]
xor ecx, ecx
test eax, eax
mov eax, dword [ebx + 0x228]
mov esi, eax
setne cl
shl esi, 4
mov edx, dword [edi + 0x130]
sub esi, eax
inc ecx
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebx + 0x1d4]
push 1
push 0x238
lea eax, [esi + 0x10c]
push eax
lea eax, [ecx + 0x130]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ebp - 0x5c]
push ecx
shl eax, 4
lea ecx, [edi + 0x130]
sub eax, dword [ebp - 0x5c]
push 0x1e
push eax
push 0x195
lea eax, [esi + 0x85]
push eax
call dword [edx + 0x48]
cmp dword [0x592ad4], 1
jne 0x4794d4
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
jmp 0x4794da
call dword [sym.imp.WINMM.dll_timeGetTime]
movss xmm0, dword [0x54c9c0]
mov ecx, eax
subss xmm0, dword [ebx + 0xec]
movss xmm1, dword [ebx + 0x244]
inc dword [ebx + 0x1c8]
push 1
mulss xmm0, dword [0x54cac0]
cvttss2si eax, xmm0
sub ecx, eax
mov eax, dword [ebp - 0x5c]
add dword [ebx + 0x228], eax
mov dword [ebx + 0x1cc], ecx
mov ecx, ebx
call fcn.0047a1d0
lea ecx, [ebp - 0x58]
call fcn.0041c2a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe27d
mov esp, ebp
pop ebp
ret
Function at 0x47e760
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x68], 0
je 0x47e7cd
xor esi, esi
lea edi, [ebx + 0x14]
mov eax, dword [edi]
cmp dword [eax + 0x2c], 0
jne 0x47e798
cmp dword [0x592ad4], 1
jne 0x47e78d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x47e793
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp eax, dword [ebx + 0x64]
jae 0x47e7a3
inc esi
add edi, 4
cmp esi, 0x14
jl 0x47e774
jmp 0x47e7cd
mov ecx, dword [ebx + esi*4 + 0x14]
call fcn.0047e930
cmp dword [0x592ad4], 1
jne 0x47e7bd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x47e7c3
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
mov eax, dword [ebx + 0x6c]
add eax, ecx
mov dword [ebx + 0x64], eax
mov eax, 0x14
lea edi, [ebx + 0x14]
mov dword [ebp - 4], eax
mov esi, dword [edi]
cmp dword [esi + 0x2c], 0
je 0x47e853
mov edx, dword [esi + 0x44]
add edx, 0xfffffff0
mov dword [esi + 0x44], edx
test edx, edx
jg 0x47e7fd
mov dword [esi + 0x44], 0
xor edx, edx
mov dword [esi + 0x2c], 0
mov ecx, dword [esi + 8]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
movss xmm1, dword [esi + 0x18]
sub esp, 8
movss xmm0, dword [esi + 0x24]
addss xmm1, dword [esi + 0x40]
addss xmm0, dword [esi + 0x3c]
mov ecx, dword [esi + 8]
movss dword [esi + 0x40], xmm1
movss dword [esi + 0x3c], xmm0
mov eax, dword [ecx]
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call dword [eax + 0xf4]
cmp dword [esi + 0x2c], 0
jne 0x47e84d
mov ecx, dword [esi + 8]
push 0
mov eax, dword [ecx]
call dword [eax + 0x20]
inc dword [esi + 0x34]
mov eax, dword [ebp - 4]
add edi, 4
sub eax, 1
mov dword [ebp - 4], eax
jne 0x47e7d8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ee50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13cc
call fcn.00517a50
mov eax, dword [0x56617c]
xor eax, esp
mov dword [esp + 0x13c8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x1c], ebx
cmp dword [ebx + 0xb8], 0
je 0x47ef2a
xor esi, esi
lea edi, [ebx + 0x14]
nop dword [eax]
mov eax, dword [edi]
cmp dword [eax + 0x2c], 0
jne 0x47eeb7
cmp dword [0x592ad4], 1
jne 0x47eea9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x47eeaf
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp eax, dword [ebx + 0xb4]
jae 0x47eec2
inc esi
add edi, 4
cmp esi, 0x14
jl 0x47ee90
jmp 0x47ef2a
mov ecx, dword [ebx + esi*4 + 0x14]
call fcn.0047f130
cmp dword [0x592ad4], 1
jne 0x47eedc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x47eee2
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, dword [ebx + 0xbc]
mov edi, eax
call fcn.004ef88f
push eax
lea ecx, [esp + 0x4c]
call fcn.0042e750
mov eax, ecx
mov dword [esp + 0x14], 0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0xb70a7c2
call fcn.0047f440
cdq
mov ecx, 0xb70a7c3
idiv ecx
mov eax, edx
cdq
idiv esi
add edx, edi
mov dword [ebx + 0xb4], edx
mov eax, 0x14
mov dword [esp + 0x14], 0xa
add ebx, 0x14
mov dword [esp + 0x10], eax
nop
mov edi, dword [ebx]
cmp dword [edi + 0x2c], 0
je 0x47f035
mov eax, dword [edi + 0x34]
xor edx, edx
shr eax, 3
div dword [esp + 0x14]
movaps xmm0, xmmword [0x54cb80]
mov ecx, dword [edi]
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x40], 0x30
movaps xmm0, xmmword [0x54cd20]
mov esi, dword [ecx]
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x44], 0x30
mov eax, dword [esp + edx*4 + 0x20]
push eax
call dword [esi + 0x38]
movss xmm1, dword [edi + 0x18]
sub esp, 8
movss xmm0, dword [edi + 0x24]
addss xmm1, dword [edi + 0x14]
addss xmm0, dword [edi + 0x10]
mov ecx, dword [edi]
movss dword [edi + 0x14], xmm1
movss dword [edi + 0x10], xmm0
mov eax, dword [ecx]
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call dword [eax + 0xf4]
cmp dword [0x592ad4], 1
jne 0x47efd3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x47efd9
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, eax
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x30]
cmp ecx, eax
jb 0x47eff0
mov dword [edi + 0x2c], 0
xor eax, eax
jmp 0x47eff3
mov eax, dword [edi + 0x2c]
movss xmm0, dword [edi + 0x10]
comiss xmm0, dword [0x54ca98]
jb 0x47f00a
mov dword [edi + 0x2c], 0
xor eax, eax
movss xmm0, dword [0x54ca30]
comiss xmm0, dword [edi + 0x14]
jb 0x47f021
mov dword [edi + 0x2c], 0
jmp 0x47f025
test eax, eax
jne 0x47f02e
mov ecx, dword [edi]
push 0
mov eax, dword [ecx]
call dword [eax + 0x20]
inc dword [edi + 0x34]
mov eax, dword [esp + 0x10]
add ebx, 4
sub eax, 1
mov dword [esp + 0x10], eax
jne 0x47ef40
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [esp + 0x13d4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fe27d
mov esp, ebp
pop ebp
ret
Function at 0x49bb60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, ecx
lea edx, [esp + 8]
mov ecx, dword [0x57e874]
push esi
push edi
push edx
mov eax, dword [ecx]
mov dword [esp + 0x10], ebx
call dword [eax + 0x34]
cmp dword [eax + 4], 0x2a6
je 0x49bca6
cmp dword [0x592ad4], 1
jne 0x49bba0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x49bba6
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [ebx + 0x150], eax
ja 0x49bca6
mov esi, 0x57e874
mov ecx, dword [esi]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [esi]
mov eax, dword [eax + 4]
mov ebx, dword [ecx]
add eax, 0xfffffffe
cmp eax, 0x2a6
jge 0x49bbe3
lea eax, [esp + 0x18]
push eax
call dword [ebx + 0x34]
push 0x2a6
jmp 0x49bbfe
lea eax, [esp + 0x20]
push eax
call dword [ebx + 0x34]
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
mov edi, dword [eax + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
lea ecx, [edi - 2]
push ecx
push dword [eax]
mov ecx, dword [esi]
call dword [ebx + 0x30]
add esi, 4
cmp esi, 0x57e898
jl 0x49bbb7
mov ecx, dword [0x57e8a8]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [0x57e8a8]
mov eax, dword [eax + 4]
sub eax, 2
cmp eax, 0x2a4
lea eax, [esp + 0x28]
push eax
jge 0x49bc4f
mov esi, dword [ecx]
call dword [esi + 0x34]
mov ecx, dword [0x57e8a8]
push 0x2a4
push dword [eax]
call dword [esi + 0x30]
jmp 0x49bc76
mov edi, dword [ecx]
call dword [edi + 0x34]
mov ecx, dword [0x57e8a8]
lea edx, [esp + 0x20]
push edx
mov esi, dword [eax + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
lea ecx, [esi - 2]
push ecx
mov ecx, dword [0x57e8a8]
push dword [eax]
call dword [edi + 0x30]
cmp dword [0x592ad4], 1
jne 0x49bc87
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x49bc8d
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0xc]
add eax, 0xf
mov dword [ecx + 0x150], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49bcb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, ecx
lea edx, [esp + 8]
mov ecx, dword [0x57e874]
push esi
push edi
push edx
mov eax, dword [ecx]
mov dword [esp + 0x10], ebx
call dword [eax + 0x34]
cmp dword [eax + 4], 0x2d0
je 0x49bdf6
cmp dword [0x592ad4], 1
jne 0x49bcf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x49bcf6
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [ebx + 0x150], eax
ja 0x49bdf6
mov esi, 0x57e874
mov ecx, dword [esi]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [esi]
mov eax, dword [eax + 4]
mov ebx, dword [ecx]
add eax, 2
cmp eax, 0x2d0
jle 0x49bd33
lea eax, [esp + 0x18]
push eax
call dword [ebx + 0x34]
push 0x2d0
jmp 0x49bd4e
lea eax, [esp + 0x20]
push eax
call dword [ebx + 0x34]
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
mov edi, dword [eax + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
lea ecx, [edi + 2]
push ecx
push dword [eax]
mov ecx, dword [esi]
call dword [ebx + 0x30]
add esi, 4
cmp esi, 0x57e898
jl 0x49bd07
mov ecx, dword [0x57e8a8]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [0x57e8a8]
mov eax, dword [eax + 4]
add eax, 2
cmp eax, 0x2d0
lea eax, [esp + 0x28]
push eax
jle 0x49bd9f
mov esi, dword [ecx]
call dword [esi + 0x34]
mov ecx, dword [0x57e8a8]
push 0x2d0
push dword [eax]
call dword [esi + 0x30]
jmp 0x49bdc6
mov edi, dword [ecx]
call dword [edi + 0x34]
mov ecx, dword [0x57e8a8]
lea edx, [esp + 0x20]
push edx
mov esi, dword [eax + 4]
mov eax, dword [ecx]
call dword [eax + 0x34]
lea ecx, [esi + 2]
push ecx
mov ecx, dword [0x57e8a8]
push dword [eax]
call dword [edi + 0x30]
cmp dword [0x592ad4], 1
jne 0x49bdd7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x49bddd
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0xc]
add eax, 0xf
mov dword [ecx + 0x150], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret