joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4411f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4740e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], 0x47739c
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], edi
lea eax, [edi + 4]
push eax
call dword [0x4760bc]
xor ebx, ebx
mov ebp, 0x47773c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x28], 1
push ecx
lea ecx, [esp + 0x14]
call fcn.00435780
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x441262
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, ebx
jne 0x441292
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 2
je 0x441279
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
add edi, 4
mov dword [esp + 0x10], 0x477768
push edi
call dword [0x4760c0]
xor eax, eax
jmp 0x441365
cmp ecx, ebx
je 0x4412ac
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x4412ae
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x4412b0
xor edi, edi
xor eax, eax
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
call dword [edx + 0xe8]
test eax, eax
jne 0x4412f5
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 3
cmp ecx, ebx
je 0x4412db
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [0x4760c0]
xor eax, eax
jmp 0x441365
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x441317
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x441319
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x14]
jmp 0x44131b
xor edi, edi
xor eax, eax
mov esi, dword [esi + 4]
cmp ecx, ebx
je 0x441333
imul eax, edi
mov edx, dword [ecx]
shl eax, 2
push eax
push esi
call dword [edx + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 4
je 0x44134a
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [0x4760c0]
mov eax, 1
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x441470
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x474148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], 0x47739c
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], edi
lea eax, [edi + 4]
push eax
call dword [0x4760bc]
xor ebx, ebx
mov ebp, 0x47773c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x30]
push ebx
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00435950
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x4414e3
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, ebx
jne 0x441513
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 2
je 0x4414fa
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
add edi, 4
mov dword [esp + 0x10], 0x477768
push edi
call dword [0x4760c0]
xor eax, eax
jmp 0x4415e6
cmp ecx, ebx
je 0x44152d
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x44152f
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x441531
xor edi, edi
xor eax, eax
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
call dword [edx + 0xe8]
test eax, eax
jne 0x441576
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 3
cmp ecx, ebx
je 0x44155c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [0x4760c0]
xor eax, eax
jmp 0x4415e6
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x441598
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x44159a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x14]
jmp 0x44159c
xor edi, edi
xor eax, eax
mov esi, dword [esi + 4]
cmp ecx, ebx
je 0x4415b4
imul eax, edi
mov edx, dword [ecx]
shl eax, 2
push eax
push esi
call dword [edx + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 4
je 0x4415cb
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [0x4760c0]
mov eax, 1
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x441740
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x474198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
lea ebp, [ebx + 0x64]
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x47739c
lea eax, [ebp + 4]
push eax
call dword [0x4760bc]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x30], 0
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x28]
test eax, eax
jne 0x44179f
add ebp, 4
push ebp
call dword [0x4760c0]
xor eax, eax
jmp 0x4418aa
mov eax, dword [esi]
mov edi, dword [ebx]
mov ecx, esi
call dword [eax + 0x30]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x2c]
push eax
mov ecx, ebx
call dword [edi + 0xe8]
test eax, eax
jne 0x4417ce
add ebp, 4
push ebp
call dword [0x4760c0]
xor eax, eax
jmp 0x4418aa
mov edi, dword [ebx + 0x18]
mov eax, dword [esi]
imul edi, dword [ebx + 0x14]
mov ecx, esi
shl edi, 2
call dword [eax + 0x28]
mov ecx, edi
mov edi, dword [ebx + 4]
mov esi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x44189b
mov ecx, ebx
call fcn.00442750
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x441878
lea ecx, [ebx + 0x3c]
sub esp, 0x10
mov edx, esp
lea esi, [ebx + 0x4c]
mov eax, dword [ecx]
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, esp
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, esi
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
lea eax, [esp + 0x38]
push eax
call fcn.0044f1b0
mov edi, eax
add esp, 0x24
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov edi, dword [edi + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edi
jmp 0x441894
lea ecx, [ebx + 0x3c]
lea edx, [ebx + 0x4c]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x20]
add ebp, 4
push ebp
call dword [0x4760c0]
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4
Function at 0x441a30
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4741d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], 0x47739c
lea ebp, [esi + 0x64]
mov dword [esp + 0x14], ebp
lea eax, [ebp + 4]
push eax
call dword [0x4760bc]
mov edi, dword [esi + 8]
mov dword [esp + 0x30], 0
test edi, edi
jne 0x441a87
add ebp, 4
push ebp
call dword [0x4760c0]
xor eax, eax
jmp 0x441ba0
mov eax, dword [esp + 0x38]
and eax, 0xffff
mov ecx, eax
shl ecx, 8
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
mov ecx, edx
sar ecx, 5
mov edx, ecx
shr edx, 0x1f
add ecx, edx
mov edx, dword [esi + 0x18]
imul edx, dword [esi + 0x14]
and ecx, 0xff
shl ecx, 8
add ecx, sym.RScript.exe_unsigned_char____256__CMath::m_ppAddTable
test edx, edx
jle 0x441af0
lea eax, [edi + 2]
mov edi, edx
xor edx, edx
mov dl, byte [eax - 2]
add eax, 4
mov dl, byte [edx + ecx]
mov byte [eax - 6], dl
xor edx, edx
mov dl, byte [eax - 5]
mov dl, byte [edx + ecx]
mov byte [eax - 5], dl
xor edx, edx
mov dl, byte [eax - 4]
dec edi
mov dl, byte [edx + ecx]
mov byte [eax - 4], dl
jne 0x441ac9
mov eax, dword [esi + 0xc]
test eax, eax
je 0x441b91
mov ecx, esi
call fcn.00442750
mov eax, dword [esi + 0x10]
test eax, eax
je 0x441b6e
lea eax, [esi + 0x3c]
sub esp, 0x10
mov ecx, esp
lea edi, [esi + 0x4c]
mov edx, dword [eax]
sub esp, 0x10
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, esp
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, edi
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x38]
push edx
call fcn.0044f1b0
mov ebx, eax
add esp, 0x24
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ebx, dword [ebx + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], ebx
jmp 0x441b8a
lea eax, [esi + 0x3c]
lea ecx, [esi + 0x4c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
add ebp, 4
push ebp
call dword [0x4760c0]
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4
Function at 0x441f90
Capabilities:
Encode data using xor
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x474258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0x47739c
lea ebp, [edi + 0x64]
mov dword [esp + 0x14], ebp
lea eax, [ebp + 4]
push eax
call dword [0x4760bc]
mov eax, dword [edi + 8]
mov dword [esp + 0x30], 0
test eax, eax
jne 0x441fe7
add ebp, 4
push ebp
call dword [0x4760c0]
xor eax, eax
jmp 0x4420bf
mov ecx, dword [edi + 0x18]
imul ecx, dword [edi + 0x14]
test ecx, ecx
jle 0x44200f
mov esi, dword [esp + 0x38]
mov edx, ecx
mov ecx, dword [eax]
add eax, 4
mov ebx, ecx
xor ebx, esi
and ebx, 0xffffff
xor ebx, ecx
dec edx
mov dword [eax - 4], ebx
jne 0x441ff8
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4420b0
mov ecx, edi
call fcn.00442750
mov eax, dword [edi + 0x10]
test eax, eax
je 0x44208d
lea ecx, [edi + 0x3c]
sub esp, 0x10
mov edx, esp
lea esi, [edi + 0x4c]
mov eax, dword [ecx]
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, esp
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, esi
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
lea eax, [esp + 0x38]
push eax
call fcn.0044f1b0
mov ebx, eax
add esp, 0x24
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ebx, dword [ebx + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
jmp 0x4420a9
lea ecx, [edi + 0x3c]
lea edx, [edi + 0x4c]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x20]
add ebp, 4
push ebp
call dword [0x4760c0]
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4
Function at 0x4471a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov ecx, dword [edi + 8]
mov edx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov dword [esp + 8], eax
call dword [edx + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0x14]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
push esi
mov ecx, edi
call fcn.004427d0
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
sub edx, edi
sub eax, esi
test edx, edx
mov dword [esp + 0x40], eax
jge 0x447211
pop edi
xor eax, eax
pop esi
add esp, 0x2c
ret 0xc
test eax, eax
jge 0x44721f
pop edi
xor eax, eax
pop esi
add esp, 0x2c
ret 0xc
xor edi, edi
test eax, eax
jle 0x447284
push ebx
push ebp
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
add ecx, edi
mov ebp, dword [esp + 0x1c]
imul ecx, dword [esp + 0x40]
add ecx, esi
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
lea esi, [esi + ecx*4]
mov ecx, dword [esp + 0x20]
add ecx, edi
imul ecx, dword [esp + 0x14]
add ecx, ebp
test edx, edx
lea ecx, [ebx + ecx*4]
jle 0x44727d
sub esi, ecx
mov ebx, edx
mov eax, dword [ecx]
add ecx, 4
mov ebp, eax
not ebp
xor ebp, eax
and ebp, 0xffffff
xor ebp, eax
dec ebx
mov dword [esi + ecx - 4], ebp
jne 0x44725f
mov eax, dword [esp + 0x48]
inc edi
cmp edi, eax
jl 0x447227
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x2c
ret 0xc
Function at 0x4472a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x48
push esi
mov esi, dword [esp + 0x50]
push edi
mov edi, ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov ecx, dword [edi + 8]
mov edx, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, esi
mov dword [esp + 0xc], eax
call dword [edx + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x14]
lea ecx, [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
push eax
push ecx
push esi
mov ecx, edi
call fcn.004427d0
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
sub eax, edi
sub edx, esi
test eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
jge 0x447315
pop edi
xor eax, eax
pop esi
add esp, 0x48
ret 0xc
test edx, edx
jge 0x447323
pop edi
xor eax, eax
pop esi
add esp, 0x48
ret 0xc
xor ecx, ecx
test edx, edx
mov dword [esp + 0x58], ecx
jle 0x447453
push ebx
push ebp
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
add esi, ecx
mov ebp, dword [esp + 0x38]
imul esi, dword [esp + 0x10]
add esi, edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
lea edi, [edi + esi*4]
mov esi, dword [esp + 0x3c]
add esi, ecx
imul esi, dword [esp + 0x18]
add esi, ebp
test eax, eax
lea esi, [ebx + esi*4]
jle 0x447444
sub edi, esi
mov dword [esp + 0x64], eax
mov dword [esp + 0x2c], edi
movzx cx, byte [esi + 3]
mov edx, dword [esi]
mov bl, cl
mov eax, edx
and ecx, 0xffff
not eax
xor eax, edx
add esi, 4
not bl
shl ecx, 8
and eax, 0xffffff
and ebx, 0xff
add ecx, sym.RScript.exe_unsigned_char____256__CMath::m_ppAddTable
xor eax, edx
mov edx, dword [edi + esi - 4]
mov ebp, ecx
shl ebx, 8
mov dword [esp + 0x20], eax
add ebx, sym.RScript.exe_unsigned_char____256__CMath::m_ppAddTable
xor ecx, ecx
mov edi, ebx
mov cl, byte [esp + 0x22]
xor ebx, ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x5c], ebp
mov bl, byte [ecx + ebp]
xor ecx, ecx
mov cl, byte [esp + 0x26]
mov ebp, ebx
xor ebx, ebx
mov dword [esp + 0x28], edi
mov bl, byte [ecx + edi]
mov edi, dword [esp + 0x5c]
xor ecx, ecx
add ebp, ebx
mov cl, ah
xor ebx, ebx
shl ebp, 8
mov bl, byte [ecx + edi]
mov edi, dword [esp + 0x28]
xor ecx, ecx
add ebp, ebx
mov cl, dh
xor ebx, ebx
and eax, 0xff
and edx, 0xff
mov bl, byte [ecx + edi]
xor ecx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x5c]
shl ebp, 8
mov cl, byte [eax + ebx]
xor eax, eax
mov al, byte [edx + edi]
mov edi, dword [esp + 0x2c]
add ebp, ecx
add ebp, eax
mov eax, dword [esp + 0x64]
mov dword [edi + esi - 4], ebp
dec eax
mov dword [esp + 0x64], eax
jne 0x447375
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x60]
inc ecx
cmp ecx, edx
mov dword [esp + 0x60], ecx
jl 0x447333
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x48
ret 0xc
Function at 0x4482e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
push esi
push edi
mov edi, dword [esp + 0x4c]
mov esi, ecx
mov ecx, edi
mov dword [esp + 8], esi
mov eax, dword [edi]
call dword [eax + 0x28]
mov ecx, dword [esi + 8]
mov edx, dword [edi]
mov dword [esp + 0x18], ecx
mov ecx, edi
mov dword [esp + 0x10], eax
call dword [edx + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push eax
push ecx
push edi
mov ecx, esi
call fcn.004427d0
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
sub eax, edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x24], eax
sub edi, edx
test eax, eax
mov dword [esp + 0x20], edi
jge 0x448359
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret 0xc
test edi, edi
jge 0x448367
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret 0xc
xor ecx, ecx
test edi, edi
mov dword [esp + 0x50], ecx
jle 0x44847c
push ebx
push ebp
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
add edx, ecx
mov ebx, dword [esp + 0x18]
imul edx, dword [esp + 0x14]
add edx, ebp
lea ebp, [ebx + edx*4]
mov edx, dword [esp + 0x34]
add edx, ecx
mov ebx, dword [esp + 0x30]
imul edx, dword [esp + 0x1c]
add edx, ebx
mov ebx, dword [esp + 0x20]
test eax, eax
lea edx, [ebx + edx*4]
jle 0x44846d
add edx, 2
mov dword [esp + 0x5c], eax
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x54]
xor eax, eax
mov ecx, dword [esi + 0x38]
xor ebx, ebx
mov al, byte [edx]
mov dword [esp + 0x24], ecx
mov edx, eax
mov eax, 0xff
imul edx, dword [esi + 0x2c]
sar edx, 8
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x26]
and eax, 0xffff
shl eax, 8
add eax, sym.RScript.exe_unsigned_char____256__CMath::m_ppAddTable
mov edi, dword [ebp]
add ebp, 4
mov bl, byte [edx + eax]
xor edx, edx
mov esi, ebx
mov dl, ch
xor ebx, ebx
and ecx, 0xff
mov bl, byte [edx + eax]
xor edx, edx
mov dl, byte [ecx + eax]
mov ecx, edi
shl esi, 8
add esi, ebx
mov eax, edi
shl esi, 8
add esi, edx
mov edx, dword [esp + 0x54]
xor ecx, esi
and eax, esi
and ecx, 0xfefefe
add edx, 4
mov dword [esp + 0x54], edx
lea eax, [ecx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
sub edi, eax
add edi, esi
mov esi, dword [esp + 0x10]
or edi, eax
mov eax, dword [esp + 0x5c]
mov dword [ebp - 4], edi
dec eax
mov dword [esp + 0x5c], eax
jne 0x4483ba
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x58]
inc ecx
cmp ecx, edi
mov dword [esp + 0x58], ecx
jl 0x448377
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x40
ret 0xc
Function at 0x462a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47509b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
call fcn.0044de70
push 0xc0
call fcn.0046335e
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x14], esi
je 0x462ac3
mov ecx, eax
call fcn.00440910
mov esi, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call dword [eax + 0xa0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x2c]
mov word [edi + 0x70], ax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
push esi
mov ecx, edi
mov word [edi + 0x72], ax
call fcn.0044def0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x46c5c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xa8]
push eax
push 0
push esi
push 0x46dc60
push 0
push 0
call fcn.00463eff
add esp, 0x18
mov dword [esi + 0xa4], eax
test eax, eax
jne 0x46c5ea
pop esi
ret
push 0xf
push eax
call dword [0x47607c]
mov edx, dword [esi + 0xd0]
lea ecx, [esi + 0xd0]
push 0xffffffffffffffff
call dword [edx + 0xc]
mov eax, 1
pop esi
ret
Function at 0x100034f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100034ff
pop dword [ebp - 0x4c]
mov eax, 0xaa8250a6
add eax, 0x657de459
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3e56c
push 0
mov eax, 0x86f88384
add eax, 0x89095dd8
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5572
mov ebx, eax
mov edx, 0xae9d9ed2
sub edx, 0x9e9abcd2
add edx, dword [ebp - 0x4c]
mov edi, 0xf7426c86
xor dword [ebp - 4], edx
mov esi, dword [edx]
mov dword [ebp - 4], 0x5760b03a
xor esi, edi
xor dword [ebp - 0x40], 0xf0208c31
mov dword [ebx], esi
sub dword [ebp - 0x40], esi
add ebx, 4
add edx, 0xe8a5d664
sub edx, 0xe8a5d660
loop 0x10003552
add eax, 0x1ffac9c1
add eax, 0xe0067eda
xor ebx, ebx
add ebx, eax
add eax, 0xb931778d
sub eax, 0xb9317788
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret