joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68d74b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x71a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0x20]
mov dword [edi], vtable.cgmanager::CCGManager.0
mov dword [edi + 4], 1
lea esi, [eax + 8]
mov dword [edi + 8], 0x8000000
mov byte [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [eax], vtable.cgmanager::CDebugCGLoader.0
mov byte [eax + 4], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0045d600
mov dword [esi], eax
lea eax, [edi + 0x30]
mov dword [ebp - 4], 0
lea esi, [eax + 8]
mov dword [eax], vtable.cgmanager::CDebugCGLoader.0
mov byte [eax + 4], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0045d600
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x463980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68dec7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x71a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], vtable.IDebugMode.0
mov dword [edi], vtable.debugfile::CDebugFile.0
mov dword [edi + 4], vtable.debugfile::CDebugFile.1.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea esi, [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
lea esi, [edi + 0x28]
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], vtable.debugfile::CVarSourceManager.0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov byte [edi + 0x6c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46b140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x71a00c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
push 0xffffffffffffffff
mov edi, ecx
mov dword [esp + 0x14], 0
push 0
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.004024e0
mov eax, dword [esp + 0x24]
cdq
and edx, 3
add edx, eax
lea eax, [esp + 0x14]
sar edx, 2
cmp dword [esp + 0x28], 0x10
cmovae eax, dword [esp + 0x14]
xor esi, esi
test edx, edx
jle 0x46b20e
cmp edx, 8
jb 0x46b1f6
mov ecx, edx
and ecx, 0x80000007
jns 0x46b1bd
dec ecx
or ecx, 0xfffffff8
inc ecx
movaps xmm2, xmmword [0x6dbe70]
mov ebx, edx
sub ebx, ecx
nop dword [eax + eax]
movups xmm0, xmmword [eax]
add esi, 8
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax], xmm1
movups xmm0, xmmword [eax + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x10], xmm1
add eax, 0x20
cmp esi, ebx
jl 0x46b1d0
cmp esi, edx
jge 0x46b20e
sub edx, esi
nop dword [eax]
xor dword [eax], 0x65656565
lea eax, [eax + 4]
sub edx, 1
jne 0x46b200
lea eax, [esp + 0x14]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov ecx, edi
push eax
mov byte [edi], 0
call fcn.00404170
mov edx, dword [esp + 0x28]
cmp edx, 0x10
jb 0x46b243
mov ecx, dword [esp + 0x14]
inc edx
push 1
call fcn.004020c0
add esp, 4
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0066bc45
mov esp, ebp
pop ebp
ret
Function at 0x46b2d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68e548
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x71a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], vtable.fileimage::CFileImageMaker.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
movss dword [ebp - 0x14], xmm0
lea ecx, [ebp - 0x30]
push dword [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.0047fb20
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.0046b430
mov edi, dword [ebp - 0x1c]
xor eax, eax
mov esi, dword [ebp - 0x20]
mov edx, edi
sub edx, esi
xor ecx, ecx
cmp esi, edi
cmova edx, eax
mov eax, esi
test edx, edx
je 0x46b3ac
cmp edx, 0x20
jb 0x46b39d
movaps xmm2, xmmword [0x6dbe70]
mov edi, edx
and edi, 0xffffffe0
movups xmm0, xmmword [eax]
add ecx, 0x20
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax], xmm1
movups xmm0, xmmword [eax + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x10], xmm1
add eax, 0x20
cmp ecx, edi
jne 0x46b374
mov edi, dword [ebp - 0x1c]
cmp ecx, edx
je 0x46b3ac
xor byte [eax], 0x65
lea eax, [eax + 1]
inc ecx
cmp ecx, edx
jne 0x46b3a1
lea eax, [esi + 4]
cmp eax, edi
ja 0x46b3db
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0x14], ecx
movss xmm0, dword [ebp - 0x14]
jmp 0x46b3de
xorps xmm0, xmm0
movss dword [ebp - 0x14], xmm0
test esi, esi
je 0x46b3f8
mov edx, dword [ebp - 0x18]
mov ecx, esi
push 1
sub edx, esi
call fcn.004020c0
add esp, 4
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x46b40e
mov edx, dword [ebp - 0x24]
push 1
sub edx, ecx
call fcn.004020c0
add esp, 4
movss xmm0, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4742d0
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
cmp edx, ecx
ja 0x4742dd
mov al, 1
ret
mov al, byte [ecx]
cmp al, 0x20
je 0x4742da
cmp al, 0x22
je 0x4742da
cmp al, 0x27
je 0x4742da
cmp al, 0xd
je 0x4742da
cmp al, 0xa
je 0x4742da
cmp al, 9
je 0x4742da
cmp al, 0x28
je 0x4742da
cmp al, 0x29
je 0x4742da
cmp al, 0x2c
je 0x4742da
cmp al, 0x3b
je 0x4742da
cmp al, 0x5b
je 0x4742da
cmp al, 0x5d
je 0x4742da
cmp al, 0x7b
je 0x4742da
cmp al, 0x7d
je 0x4742da
cmp al, 0x2b
je 0x4742da
cmp al, 0x2d
je 0x4742da
cmp al, 0x2a
je 0x4742da
cmp al, 0x2f
je 0x4742da
cmp al, 0x3c
je 0x4742da
cmp al, 0x3e
je 0x4742da
cmp al, 0x25
je 0x4742da
cmp al, 0x26
je 0x4742da
cmp al, 0x7c
je 0x4742da
cmp al, 0x7e
je 0x4742da
cmp al, 0x5e
je 0x4742da
cmp al, 0x3d
je 0x4742da
cmp al, 0x40
je 0x4742da
inc ecx
cmp edx, ecx
jbe 0x474359
cmp al, 0x81
jne 0x474359
cmp byte [ecx], 0x40
je 0x4742da
xor al, al
ret

Function at 0x4836b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push edi
mov edi, dword [0x72ebd4]
mov ecx, edi
call fcn.004835c0
test al, al
jne 0x4836ca
xor al, al
pop edi
pop ecx
ret 4
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test al, al
je 0x4836c3
push esi
mov esi, dword [esp + 0x10]
lea eax, [esi - 0x79]
cmp eax, 0xe
jbe 0x48371a
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x48371a
test esi, esi
jle 0x483722
cmp esi, 2
jle 0x483703
cmp esi, 4
jne 0x483722
mov ecx, dword [edi + 0xc]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0xc]
push edx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test al, al
jne 0x483722
pop esi
xor al, al
pop edi
pop ecx
ret 4
pop esi
mov al, 1
pop edi
pop ecx
ret 4
Function at 0x4841f0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 0x10
push ebx
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x24], ecx
jne 0x484228
cmp dword [esi + 0x28], eax
jne 0x484228
xor bl, bl
jmp 0x48422a
mov bl, 1
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jne 0x484353
push dword [esp + 0xc]
mov edx, dword [esp + 0xc]
call fcn.00484480
add esp, 4
test al, al
je 0x484353
cmp byte [esi + 0x20], 0
je 0x484281
cmp byte [esi + 0x3b], 0
jne 0x484272
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
mov byte [esi + 0x3b], 1
mov ecx, esi
call fcn.00484500
pop esi
pop ebx
add esp, 0x10
ret 4
cmp byte [esi + 0x3a], 0
je 0x4842a5
cmp byte [esi + 0x3b], 0
je 0x4843ad
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
mov byte [esi + 0x3b], 0
pop esi
pop ebx
add esp, 0x10
ret 4
cmp byte [esi + 4], 0
je 0x4842ff
test bl, bl
je 0x4842d7
cmp byte [esi + 0x21], 0
je 0x4842c0
mov ecx, esi
mov byte [esi + 0x21], 0
call fcn.00484560
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x4842d0
mov eax, dword [ecx]
call dword [eax]
mov dword [esi + 0x2c], eax
jmp 0x4842ff
xor eax, eax
mov dword [esi + 0x2c], eax
jmp 0x4842ff
cmp byte [esi + 0x21], 0
jne 0x4842ff
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x4842ea
mov eax, dword [ecx]
call dword [eax]
jmp 0x4842ec
xor eax, eax
sub eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
jb 0x4842ff
mov ecx, esi
mov byte [esi + 0x21], 1
call fcn.00484580
cmp byte [esi + 5], 0
je 0x484323
cmp byte [esi + 0x38], 0
je 0x484323
test bl, bl
je 0x484323
mov ecx, esi
mov word [esi + 0x38], 0
call fcn.00484560
mov ecx, esi
call fcn.00484500
cmp byte [esi + 6], 0
je 0x4843ad
cmp byte [esi + 0x39], 0
je 0x4843ad
test bl, bl
je 0x4843ad
mov ecx, esi
mov word [esi + 0x38], 0
call fcn.00484560
mov ecx, esi
call fcn.00484500
pop esi
pop ebx
add esp, 0x10
ret 4
cmp byte [esi + 0x3b], 0
jne 0x484365
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
mov byte [esi + 0x3b], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x28], eax
mov byte [esi + 0x21], 0
test ecx, ecx
je 0x4843a8
mov eax, dword [ecx]
call dword [eax]
mov dword [esi + 0x2c], eax
pop esi
pop ebx
add esp, 0x10
ret 4
xor eax, eax
mov dword [esi + 0x2c], eax
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x48c9f1
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x48ca14
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x48c900
push 0
push 0
call fcn.00675eb6
add esp, 0x18
test eax, eax
jne 0x48ca36
xor al, al
pop esi
pop ecx
ret
mov dword [esi + 0x20], eax
mov al, 1
pop esi
pop ecx
ret

Function at 0x495f90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [ecx + 4], eax
mov dword [ecx + 0x9c4], 1
push esi
mov esi, dword [ecx + 0x9c4]
mov edx, dword [ecx + esi*4]
shr edx, 0x1e
xor edx, dword [ecx + esi*4]
imul eax, edx, 0x6c078965
add eax, esi
mov dword [ecx + esi*4 + 4], eax
inc dword [ecx + 0x9c4]
cmp dword [ecx + 0x9c4], 0x270
jl 0x495fa2
pop esi
ret 4

Function at 0x495fe0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c4]
cmp eax, 0x270
jl 0x4960b7
cmp eax, 0x271
jne 0x496005
push 0x1571
call fcn.00495f90
push ebx
push edi
lea edx, [esi + 4]
mov edi, 0xe3
nop
mov ecx, dword [edx + 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x6d7e80]
xor ecx, dword [edx + 0x630]
mov dword [edx - 4], ecx
sub edi, 1
jne 0x496010
lea edx, [esi + 0x390]
mov edi, 0x18c
nop dword [eax]
mov ecx, dword [edx + 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x6d7e80]
xor ecx, dword [edx - 0x390]
mov dword [edx - 4], ecx
sub edi, 1
jne 0x496050
mov ecx, dword [esi + 0x9c0]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x6d7e80]
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
mov dword [esi + 0x9c4], edi
pop edi
pop ebx
mov ecx, dword [esi + 0x9c4]
lea eax, [ecx + 1]
mov dword [esi + 0x9c4], eax
mov ecx, dword [esi + ecx*4 + 4]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret

Function at 0x496740
Capabilities:
Encode data using xor

Disassembly:
inc dword [ecx + 0x82c]
lea edx, [ecx + 4]
push esi
mov esi, 8
nop
mov eax, dword [edx + 0x7a4]
lea edx, [edx + 0x10]
xor dword [edx - 0x10], eax
mov eax, dword [edx + 0x798]
xor dword [edx - 0xc], eax
mov eax, dword [edx + 0x79c]
xor dword [edx - 8], eax
mov eax, dword [edx + 0x7a0]
xor dword [edx - 4], eax
sub esi, 1
jne 0x496750
lea eax, [ecx + 0x84]
mov edx, 0xa3
pop esi
nop dword [eax + eax]
mov ecx, dword [eax - 0x80]
lea eax, [eax + 0xc]
xor dword [eax - 0xc], ecx
mov ecx, dword [eax - 0x88]
xor dword [eax - 8], ecx
mov ecx, dword [eax - 0x84]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x496790
ret
Function at 0x4967c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x82c], 0
jle 0x496822
push ebx
push edi
nop
lea ecx, [esi + 0x824]
mov edx, 0x1e9
nop dword [eax + eax]
mov eax, dword [ecx - 0x80]
lea ecx, [ecx - 4]
xor dword [ecx + 4], eax
sub edx, 1
jne 0x4967e0
mov edx, 0x1f
lea eax, [esi + 0x80]
nop dword [eax]
mov ecx, dword [eax + 0x7a4]
lea eax, [eax - 4]
xor dword [eax + 4], ecx
sub edx, 1
jns 0x496800
dec dword [esi + 0x82c]
cmp dword [esi + 0x82c], 0
jg 0x4967d0
pop edi
pop ebx
mov dword [esi + 0x82c], 0
mov dword [esi], 0xffffffff
pop esi
ret

Function at 0x496840
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebx, ecx
xor eax, eax
push esi
mov esi, dword [esp + 0x10]
push edi
lea edi, [ebx + 4]
lea ebp, [eax + 0x11]
mov edx, 0x20
imul esi, esi, 0x5d588b65
shr eax, 1
inc esi
mov ecx, esi
and ecx, 0x80000000
or eax, ecx
sub edx, 1
jne 0x496857
mov dword [edi], eax
add edi, 4
sub ebp, 1
jne 0x496852
mov ecx, dword [ebx + 0x44]
lea edx, [ebx + 8]
mov eax, dword [ebx + 4]
mov edi, 0x1f8
shl ecx, 0x17
shr eax, 9
xor ecx, eax
xor ecx, dword [ebx + 0x40]
mov dword [ebx + 0x44], ecx
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
mov eax, dword [edx - 4]
shl ecx, 0x17
shr eax, 9
xor ecx, eax
xor ecx, dword [edx + 0x38]
mov dword [edx + 0x3c], ecx
sub edi, 1
jne 0x496895
mov ecx, ebx
call fcn.00496740
mov ecx, ebx
call fcn.00496740
mov ecx, ebx
call fcn.00496740
mov ecx, ebx
call fcn.00496740
mov dword [ebx + 0x82c], edi
pop edi
mov dword [ebx + 0x828], esi
pop esi
pop ebp
mov dword [ebx], 0xffffffff
pop ebx
ret 4
Function at 0x4ae900
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x692e49
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x71a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov dword [esi], vtable.partsengine::CConstructionProcess.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], vtable.partsengine::CCharSpriteProperty.0
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
movups xmm0, xmmword [edi + 0x68]
movups xmmword [esi + 0x68], xmm0
mov eax, dword [edi + 0x78]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x7c]
mov dword [esi + 0x7c], eax
movups xmm0, xmmword [edi + 0x80]
movups xmmword [esi + 0x80], xmm0
lea ecx, [esi + 0x90]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
lea edx, [edi + 0x90]
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4aea17
mov eax, dword [ecx]
jmp 0x4aea19
mov eax, ecx
push 0xffffffffffffffff
push 0
push edx
mov byte [eax], 0
call fcn.004024e0
push 0xffffffffffffffff
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 1
lea eax, [edi + 0xa8]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004024e0
mov al, byte [edi + 0xc0]
mov byte [esi + 0xc0], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4b46b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x693452
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x71a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x3c]
mov dword [edi], vtable.partsengine::CFlatData.0
mov dword [edi + 4], 1
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0045d600
mov dword [esi], eax
lea esi, [edi + 0x44]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
lea esi, [edi + 0x4c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00421820
mov dword [esi], eax
lea esi, [edi + 0x54]
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
lea esi, [edi + 0x5c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
lea esi, [edi + 0x64]
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
lea esi, [edi + 0x6c]
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430590
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x88], 0xf
mov dword [edi + 0x84], 0
mov byte [edi + 0x74], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b9bb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x693861
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x71a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], vtable.partsengine::CFlatEmitterView.0
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
call fcn.00508be0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4bf050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x693bd6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x71a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], vtable.partsengine::CFlatSpriteView.0
mov dword [edi + 4], 1
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
lea esi, [edi + 0x28]
mov byte [ebp - 4], 1
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004199d0
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x30], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4