joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d640
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549890
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x57a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x637688
call ebx
sub eax, dword [edi]
cmp eax, 0x3e8
jb 0x44d7e8
call ebx
push 0
mov dword [edi], eax
call fcn.0052d9f5
add esp, 4
mov esi, eax
mov eax, dword [edi - 4]
push edx
cdq
push esi
push edx
push eax
call fcn.0052d9b0
fstp qword [ebp - 0x18]
cvttsd2si esi, qword [ebp - 0x18]
add esp, 0x10
mov dword [edi - 8], esi
cmp dword [0x6374f4], 0
jne 0x44d6cb
cmp dword [0xbd8f14], 0xffffffff
je 0x44d6f8
mov dword [0xbd8f14], 0xffffffff
jmp 0x44d6f8
test esi, esi
js 0x44d6f8
mov eax, dword [0xbd8f14]
cmp esi, eax
jl 0x44d6dc
test eax, eax
jg 0x44d6f8
cmp dword [edi - 0xc], 1
jne 0x44d6ea
mov dword [0xbd8f14], esi
jmp 0x44d6f8
test eax, eax
je 0x44d6f8
mov dword [0xbd8f14], 0
mov eax, dword [edi - 0xc]
sub eax, 0
je 0x44d7e8
sub eax, 1
je 0x44d720
sub eax, 1
jne 0x44d7e8
lea eax, [edi - 0x10]
push eax
call fcn.0044d810
jmp 0x44d7e8
test esi, esi
jle 0x44d787
mov ecx, dword [edi + 0x3c]
shl ecx, 4
sub ecx, dword [edi + 0x3c]
shl ecx, 2
cmp esi, ecx
jg 0x44d787
mov eax, esi
mov ecx, 0x3c
cdq
idiv ecx
test edx, edx
jne 0x44d745
dec eax
jmp 0x44d758
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [edi + 4], eax
cmp eax, dword [edi + 8]
je 0x44d787
mov dword [edi + 8], eax
inc eax
push eax
lea eax, [edi + 0xc]
push eax
push 0x6374f8
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb90558
call fcn.004cdd70
add esp, 0x28
cmp dword [edi - 8], 0
jg 0x44d7e8
lea eax, [edi + 0xc]
push eax
push 0x637578
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb90558
call fcn.004cdd70
mov ecx, dword [edi + 0x40]
add esp, 0x24
shl ecx, 4
sub ecx, dword [edi + 0x40]
shl ecx, 2
push 0
mov dword [edi - 0xc], 2
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], 0xffffffff
mov dword [edi - 8], ecx
call fcn.0052d9f5
mov ecx, dword [edi - 8]
add esp, 4
add ecx, eax
mov dword [ebp - 0x14], edx
mov dword [edi - 4], ecx
add edi, 0x6c
cmp edi, 0x637ac0
jl 0x44d673
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x64377c]
cmp eax, 0x3e8
jb case.0x469a9b.0
call esi
push 0
mov dword [0x64377c], eax
call fcn.0052d9f5
add esp, 4
mov esi, eax
mov eax, dword [0x643778]
push edx
cdq
push esi
push edx
push eax
call fcn.0052d9b0
fmul qword [0x56a7f0]
add esp, 0x10
fstp qword [esp + 8]
cvttsd2si eax, qword [esp + 8]
mov dword [0x643774], eax
mov eax, dword [0x64376c]
cmp eax, 3
ja case.0x469a9b.0
jmp dword [eax*4 + 0x469bac]
call fcn.0046a8d0
call fcn.0046a920
test eax, eax
je 0x469b98
mov eax, dword [0x643774]
test eax, eax
jle 0x469b1c
cmp eax, 0x7530
jg 0x469b14
cmp dword [0x643780], 0
jne 0x469b14
mov dword [esp + 8], 0x119204c1
mov esi, 0x6437a0
nop word [eax + eax]
mov eax, dword [esi]
test eax, eax
js 0x469afa
cmp eax, 0x1194
jge 0x469afa
push 4
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.005192f0
add esi, 4
cmp esi, 0x6437b4
jl 0x469ae0
mov eax, dword [0x643774]
mov dword [0x643780], 1
test eax, eax
jg case.0x469a9b.0
push 2
call fcn.0046a0e0
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00469bc0
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0046a8d0
mov eax, dword [0x643774]
test eax, eax
jle 0x469b98
cmp eax, 0x7530
jg 0x469b94
cmp dword [0x643780], 0
jne 0x469b94
mov dword [esp + 8], 0x139204c1
mov esi, 0x6437a0
nop dword [eax]
mov eax, dword [esi]
test eax, eax
js 0x469b7a
cmp eax, 0x1194
jge 0x469b7a
push 4
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.005192f0
add esi, 4
cmp esi, 0x6437b4
jl 0x469b60
mov eax, dword [0x643774]
mov dword [0x643780], 1
test eax, eax
jg case.0x469a9b.0
mov dword [0x64376c], 0
call fcn.0046a320
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46a0e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 8
mov dword [0x64376c], eax
push esi
push edi
cmp eax, 3
ja case.default.0x46a0fc
jmp dword [eax*4 + 0x46a30c]
call fcn.0046a320
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov dword [0x643780], 0
mov dword [0x643788], 0
mov dword [0x64378c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [0x643768]
mov dword [0x64379c], eax
movzx esi, byte [edi*4 + 0x553fd4]
movzx eax, byte [edi*4 + 0x553fd6]
cmp esi, eax
ja 0x46a1d1
nop dword [eax]
nop word [eax + eax]
movzx eax, byte [edi*4 + 0x553fd5]
movzx ecx, byte [edi*4 + 0x553fd7]
cmp eax, ecx
ja 0x46a1c4
nop dword [eax]
nop dword [eax + eax]
imul edx, dword [0x643770], 0x15d38
test esi, esi
js 0x46a1b7
cmp esi, dword [edx + 0xd2f384]
jge 0x46a1b7
test eax, eax
js 0x46a1b7
mov ecx, dword [edx + 0xd2f388]
cmp eax, ecx
jge 0x46a1b7
imul ecx, eax
add ecx, dword [edx + 0xd2f380]
or byte [ecx + esi], 4
mov edi, dword [0x643768]
movzx ecx, byte [edi*4 + 0x553fd7]
inc eax
cmp eax, ecx
jle 0x46a180
movzx eax, byte [edi*4 + 0x553fd6]
inc esi
cmp esi, eax
jle 0x46a160
mov esi, 0x6437a0
mov ecx, dword [esi]
test ecx, ecx
js 0x46a200
cmp ecx, 0x1194
jge 0x46a200
lea eax, [edi*4 + 0x553fd4]
push eax
push 1
push 0
push 4
call fcn.004e97e0
mov edi, dword [0x643768]
add esp, 0x10
add esi, 4
cmp esi, 0x6437b4
jl 0x46a1d6
mov dword [esp + 8], 0x10bf05c1
mov esi, 0x6437a0
mov byte [esp + 0xc], 1
nop dword [eax]
mov eax, dword [esi]
test eax, eax
js 0x46a23a
cmp eax, 0x1194
jge 0x46a23a
push 5
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.005192f0
add esi, 4
cmp esi, 0x6437b4
jl 0x46a220
imul eax, dword [0x64374c], 0xea60
push 0
mov dword [0x643774], eax
call fcn.0052d9f5
mov esi, eax
add esp, 4
mov eax, 0x10624dd3
imul dword [0x643774]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, esi
mov dword [0x643778], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov dword [0x643780], 0
mov dword [0x643788], 0
mov dword [0x64378c], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x64379c], eax
call fcn.0046c030
mov dword [esp + 8], 0x10bf05c1
mov esi, 0x6437a0
mov byte [esp + 0xc], 2
mov eax, dword [esi]
test eax, eax
js 0x46a2df
cmp eax, 0x1194
jge 0x46a2df
push 5
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.005192f0
add esi, 4
cmp esi, 0x6437b4
jl 0x46a2c5
call fcn.0046c770
imul eax, dword [0x643750], 0xea60
jmp 0x46a24f
call fcn.0046a500
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x474fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x57a040]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push esi
push edi
mov edi, 0xdac
mov ebx, edi
mov esi, dword [ebx*4 + 0x20a514c]
cmp dword [esi + 4], 3
je 0x474fd6
jmp 0x475174
mov eax, dword [esi + 0x3ec]
test eax, eax
js 0x475069
cmp eax, 0x1194
jge 0x475069
call ecx
sub eax, dword [esi + 0x3fc]
cmp eax, 0x7530
jbe 0x475063
mov eax, dword [esi + 0x3ec]
push dword [eax*4 + 0x20a514c]
call fcn.004751a0
mov ecx, dword [esi + 0x3ec]
lea edx, [esp + 0x20]
mov eax, ecx
mov byte [esp + 0x26], cl
shr eax, 8
mov byte [esp + 0x25], al
mov eax, dword [ecx*4 + 0x20a514c]
mov ecx, dword [esi]
mov dword [esp + 0x20], 0x1aa11c1
mov byte [esp + 0x24], 0xf
movq xmm0, qword [eax + 0x86]
movq qword [esp + 0x27], xmm0
mov ax, word [eax + 0x8e]
push 0x11
mov word [esp + 0x33], ax
call fcn.00526480
add esp, 4
push esi
call fcn.004751a0
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [esi + 0x3f0]
test eax, eax
js 0x4750f2
cmp eax, 0x1194
jge 0x4750f2
call ecx
sub eax, dword [esi + 0x3fc]
cmp eax, 0x7530
jbe 0x4750f2
mov eax, dword [esi + 0x3f0]
push dword [eax*4 + 0x20a514c]
call fcn.004751a0
mov ecx, dword [esi]
lea edx, [esp + 0x20]
mov eax, ecx
mov byte [esp + 0x26], cl
shr eax, 8
mov byte [esp + 0x25], al
mov eax, dword [ecx*4 + 0x20a514c]
mov ecx, dword [esi + 0x3f0]
mov dword [esp + 0x20], 0x1aa11c1
mov byte [esp + 0x24], 0xf
movq xmm0, qword [eax + 0x86]
movq qword [esp + 0x27], xmm0
mov ax, word [eax + 0x8e]
push 0x11
mov word [esp + 0x33], ax
call fcn.00526480
add esp, 4
push esi
call fcn.004751a0
mov eax, dword [esi + 0x3f4]
mov edi, ebx
test eax, eax
js 0x47516e
cmp eax, 0x1194
jge 0x47516e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x3fc]
cmp eax, 0xea60
jbe 0x47516e
mov eax, dword [esi + 0x3f4]
push dword [eax*4 + 0x20a514c]
call fcn.004751a0
mov ecx, dword [esi + 0x3f4]
lea edx, [esp + 0x10]
push 5
mov dword [esp + 0x14], 0x3aa05c1
mov byte [esp + 0x18], 0
call fcn.00526480
add esp, 4
push esi
call fcn.004751a0
mov ecx, dword [esi]
lea edx, [esp + 0x18]
push 5
mov dword [esp + 0x1c], 0x3aa05c1
mov byte [esp + 0x20], 0
call fcn.00526480
add esp, 4
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
inc edi
cmp edi, 0x1194
jl 0x474fc2
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret
Function at 0x47efe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x64b374]
cmp eax, 0x3e8
jb case.0x47f084.0
call esi
push 0
mov dword [0x64b374], eax
call fcn.0052d9f5
add esp, 4
mov esi, eax
mov eax, dword [0x64b38c]
push edx
cdq
push esi
push edx
push eax
call fcn.0052d9b0
mov eax, dword [0x64b364]
add esp, 0x10
cmp dword [0xbdccd8], 0
fstp qword [esp + 8]
cvttsd2si ecx, qword [esp + 8]
mov dword [0x64b368], ecx
jne 0x47f05b
cmp dword [0xbd8f18], 0xffffffff
je 0x47f07b
mov dword [0xbd8f18], 0xffffffff
jmp 0x47f07b
cmp eax, 1
jne 0x47f068
mov dword [0xbd8f18], ecx
jmp 0x47f07b
cmp dword [0xbd8f18], 0
je 0x47f07b
mov dword [0xbd8f18], 0
cmp eax, 4
ja case.0x47f084.0
jmp dword [eax*4 + 0x47f1a8]
call fcn.0047f1c0
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0047f400
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00480190
xor edx, edx
mov eax, 0x64b3e4
nop dword [eax + eax]
mov ecx, dword [eax]
test ecx, ecx
js 0x47f0bf
cmp ecx, 0x1194
jge 0x47f0bf
inc edx
add eax, 0x14
cmp eax, 0x64b704
jl 0x47f0b0
test edx, edx
je 0x47f18f
xor edx, edx
mov eax, 0x64b3e4
mov ecx, dword [eax]
test ecx, ecx
js 0x47f0e7
cmp ecx, 0x1194
jge 0x47f0e7
inc edx
add eax, 0x14
cmp eax, 0x64b704
jl 0x47f0d8
cmp edx, 1
je 0x47f170
cmp dword [0x64b368], 0
jg case.0x47f084.0
lea eax, [esp + 8]
mov dword [esp + 8], 0x33e
push eax
lea eax, [esp + 0x18]
mov ecx, 0xa9b83c
push eax
call fcn.00405650
mov eax, dword [esp + 0x1c]
mov ecx, dword [0xa9b83c]
cmp byte [eax + 0xd], 0
jne 0x47f138
cmp dword [eax + 0x10], 0x33e
jle 0x47f13a
mov eax, ecx
cmp eax, ecx
jne 0x47f15d
push 0x33e
push str.Could_not_find_message__d_
push 0xa9b7bc
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, 0xa9b7bc
jmp 0x47f160
add eax, 0x18
push eax
push 0
push 0x64b360
call fcn.004804f0
add esp, 0xc
push 4
mov ecx, 0x64b360
call fcn.0047f600
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00480190
cmp dword [0x64b368], 0
jg case.0x47f084.0
mov ecx, 0x64b360
mov dword [0x64b364], 1
call fcn.0047f840
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47f600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x57a040]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 4], eax
cmp eax, 4
ja case.0x47f628.0
jmp dword [eax*4 + 0x47f828]
call fcn.0047f840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0xc]
shl ecx, 4
sub ecx, dword [esi + 0xc]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], 0xffffffff
jmp 0x47f7fb
mov ecx, dword [esi + 0x1c]
shl ecx, 4
sub ecx, dword [esi + 0x1c]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], 0xffffffff
jmp 0x47f7fb
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], 0xffffffff
cmp eax, dword [esi + 0x38]
jle 0x47f6c0
mov dword [esp + 0xc], 1
push str.Win_BLUE_Team_
jmp 0x47f6cf
jge 0x47f6da
mov dword [esp + 0xc], 2
push str.Win_RED_Team_
push 0
push esi
call fcn.004804f0
add esp, 0xc
lea edi, [esi + 0x84]
mov ebx, 0x28
mov ecx, dword [edi]
test ecx, ecx
js 0x47f7e6
cmp ecx, 0x1194
jge 0x47f7e6
mov ecx, dword [ecx*4 + 0x20a514c]
call fcn.00520340
mov eax, dword [edi]
push dword [eax*4 + 0x20a514c]
call fcn.004d3660
mov eax, dword [esp + 0xc]
cmp dword [edi + 8], eax
jne 0x47f7e6
mov eax, dword [edi]
mov edx, dword [esi + 0x74]
mov eax, dword [eax*4 + 0x20a514c]
mov dword [esp + 0x10], eax
test edx, edx
jg 0x47f74b
cmp dword [esi + 0x78], 0
jg 0x47f74b
cmp dword [esi + 0x7c], 0
jg 0x47f74b
cmp dword [esi + 0x80], 0
jle 0x47f766
push ecx
push dword [esi + 0x80]
mov ecx, dword [eax]
push dword [esi + 0x7c]
push dword [esi + 0x78]
call fcn.004740a0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [eax]
mov word [esp + 0x1c], ax
mov word [esp + 0x18], 0x24c1
mov byte [esp + 0x1a], 0x56
mov ecx, dword [eax*4 + 0x20a514c]
push 0x24
movq xmm0, qword [ecx + 0x7b]
movq qword [esp + 0x22], xmm0
movzx eax, word [ecx + 0x83]
mov word [esp + 0x2a], ax
movzx eax, byte [ecx + 0x85]
mov byte [esp + 0x2c], al
movq xmm0, qword [ecx + 0x86]
movq qword [esp + 0x2d], xmm0
movzx eax, word [ecx + 0x8e]
mov word [esp + 0x35], ax
movzx eax, byte [ecx + 0x90]
mov ecx, 0x7509e0
mov byte [esp + 0x37], al
mov eax, dword [edi + 0xc]
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
call fcn.00440610
add edi, 0x14
sub ebx, 1
jne 0x47f6e5
mov ecx, dword [esi + 0x10]
shl ecx, 4
sub ecx, dword [esi + 0x10]
shl ecx, 2
push 0
mov dword [esi + 8], ecx
call fcn.0052d9f5
mov ecx, dword [esi + 8]
add esp, 4
add ecx, eax
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 4
Function at 0x4855e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x57a040]
xor eax, esp
mov dword [esp + 0x30], eax
cmp dword [0xbdac34], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
je 0x4857ef
mov esi, dword [edi*4 + 0x20a514c]
test edi, edi
js 0x4857ef
cmp edi, 0x1194
jge 0x4857ef
cmp dword [esi + 4], 3
jne 0x4857ef
movzx eax, word [esi + 0x78]
cmp eax, 1
je 0x48563e
cmp eax, 6
jne 0x4857ef
cmp byte [esi + 0xa], 0
jg 0x4857ef
cmp byte [esi + 0x9c0], 0
jne 0x4857ef
mov eax, dword [esi + 0x384]
test al, 3
je 0x4857ef
and eax, 0xffc0
cmp eax, 0x440
jne 0x4857ef
mov ebx, dword [esi + 0x758]
test ebx, ebx
jne 0x4856ab
push 5
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x4f805c1
push eax
push edi
mov byte [esp + 0x20], 1
call fcn.005192f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0xbdac38]
test eax, eax
je 0x4856eb
cmp dword [esi + 0x28c], 0
je 0x4856eb
push 5
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x4f805c1
push eax
push edi
mov byte [esp + 0x20], 2
call fcn.005192f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0xbdac3c]
test ecx, ecx
je 0x485707
mov edx, dword [esi + 0x284]
test edx, edx
js 0x485707
cmp edx, 0x1194
jl 0x4856bd
test eax, eax
je 0x48574b
cmp dword [esi + 0x6d4], 0
jne 0x48571d
cmp dword [esi + 0x6d8], 0
je 0x48574b
push 5
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x4f805c1
push eax
push edi
mov byte [esp + 0x20], 4
call fcn.005192f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 8
test ecx, ecx
je 0x485761
cmp dword [esi + 0x6dc], 0
jne 0x48571d
cmp dword [esi + 0x6e0], 0
jne 0x48571d
cmp ebx, 1
jne 0x485803
cmp dword [esi + 0x750], 0x21f
jne 0x48581c
lea edx, [esi + 0x7b]
mov ecx, edi
call fcn.0051f8f0
test al, al
je 0x4857ef
mov dword [esp + 0x18], 0x11124c1
mov ecx, 0x7509e0
mov word [esp + 0x1c], di
movq xmm0, qword [esi + 0x7b]
movq qword [esp + 0x1e], xmm0
movzx eax, word [esi + 0x83]
mov word [esp + 0x26], ax
mov al, byte [esi + 0x85]
mov byte [esp + 0x28], al
movq xmm0, qword [esi + 0x86]
movq qword [esp + 0x29], xmm0
movzx eax, word [esi + 0x8e]
mov word [esp + 0x31], ax
mov al, byte [esi + 0x90]
mov byte [esp + 0x33], al
lea eax, [esp + 0x18]
push 0x24
push eax
mov byte [esp + 0x3c], bl
call fcn.00440610
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 8
cmp ebx, 2
jne 0x48577a
cmp dword [esi + 0x750], 0x220
je 0x48577a
push 5
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x4f805c1
push eax
push edi
mov byte [esp + 0x20], 3
call fcn.005192f0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 8
Function at 0x486760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x858
mov eax, dword [0x57a040]
xor eax, esp
mov dword [esp + 0x854], eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0x3c], ecx
push esi
push edi
mov eax, dword [ecx*4 + 0x20a514c]
test ecx, ecx
js 0x486948
cmp ecx, 0x1194
jge 0x486948
cmp dword [eax + 4], 3
jne 0x486948
movzx ecx, word [eax + 0x78]
cmp ecx, 1
je 0x4867ba
cmp ecx, 6
jne 0x486948
cmp byte [eax + 0xa], 0
jg 0x486948
cmp byte [eax + 0x9c0], 0
jne 0x486948
cmp dword [eax + 0x28c], 0
je 0x486948
mov esi, dword [eax + 0x290]
xor dl, dl
mov ecx, 0x85133c
mov byte [esp + 0x20], 0xc2
mov word [esp + 0x23], 0x152
mov dword [esp + 0x18], 0x18
mov eax, dword [esi + 0x598]
mov edi, dword [esi + 0x720]
mov dword [esp + 0x28], eax
mov al, byte [esi + 0x595]
mov byte [esp + 0x2c], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x29], dl
push eax
mov dword [esp + 0x1c], edi
call fcn.00405650
mov eax, dword [esp + 0x50]
mov ecx, dword [0x85133c]
cmp byte [eax + 0xd], 0
jne 0x486845
cmp edi, dword [eax + 0x10]
jge 0x486847
mov eax, ecx
cmp eax, ecx
je 0x486860
mov eax, dword [eax + 0x14]
test eax, eax
je 0x486860
movq xmm0, qword [eax + 4]
mov al, byte [eax + 0xc]
mov byte [esp + 0x35], al
jmp 0x486868
xorps xmm0, xmm0
mov byte [esp + 0x35], 0
lea eax, [esp + 0x70]
movq qword [esp + 0x2d], xmm0
mov dword [esp + 0x10], eax
lea edx, [esi + 0x490]
lea edi, [esi + 0x5d8]
mov eax, 0x50
add esi, 0x2f
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], esi
cmp byte [edx - 0x50], 0
je 0x4868f7
mov ax, word [esi + 8]
mov cl, byte [edx]
movq xmm0, qword [esi]
mov esi, dword [esp + 0x10]
mov word [esp + 0x50], ax
mov al, cl
sar al, 7
and al, 0x80
mov byte [esp + 0x52], cl
sub al, 0x80
and cl, 0x7f
or al, cl
mov cl, byte [edi]
mov byte [esp + 0x53], al
mov eax, dword [esp + 0x10]
movq qword [eax], xmm0
mov eax, dword [esp + 0x50]
mov dword [esi + 8], eax
mov eax, esi
mov esi, dword [esp + 0x1c]
mov byte [eax + 0xc], cl
add eax, 0xd
mov ecx, dword [esp + 0x18]
add ecx, 0xd
mov dword [esp + 0x10], eax
inc byte [esp + 0x25]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
jmp 0x4868fb
mov ecx, dword [esp + 0x18]
add esi, 0xb
add edi, 4
inc edx
mov dword [esp + 0x1c], esi
sub eax, 1
mov dword [esp + 0x14], eax
jne 0x486892
cmp byte [esp + 0x25], 0
je 0x486948
mov eax, ecx
mov byte [esp + 0x22], cl
shr eax, 8
mov byte [esp + 0x21], al
lea eax, [esp + 0x58]
movups xmm0, xmmword [esp + 0x20]
push ecx
push eax
push dword [esp + 0x4c]
movups xmmword [esp + 0x64], xmm0
movq xmm0, qword [esp + 0x3c]
movq qword [esp + 0x74], xmm0
call fcn.005192f0
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 4
Function at 0x488c20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov bh, byte [0xbf8c9d]
mov bl, byte [0xbf8c9c]
push esi
mov esi, ecx
push edi
test bh, bh
jne 0x488c3d
test bl, bl
je 0x488ce3
xor ecx, ecx
test edx, edx
jle 0x488ce3
cmp edx, 0x40
jb 0x488cd0
movsx eax, bh
mov edi, edx
and edi, 0xffffffc0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx eax, bl
pshufd xmm2, xmm0, 0
movd xmm0, eax
lea eax, [esi + 0x20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm3, xmm0, 0
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add ecx, 0x40
movaps xmm1, xmm2
xorps xmm1, xmm0
psubb xmm1, xmm3
movups xmmword [eax - 0x60], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x50]
xorps xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
xorps xmm1, xmm0
psubb xmm1, xmm3
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
xorps xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [eax - 0x30], xmm0
cmp ecx, edi
jl 0x488c80
cmp ecx, edx
jge 0x488ce3
mov al, byte [ecx + esi]
xor al, bh
sub al, bl
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jl 0x488cd0
xor ecx, ecx
jmp 0x488ced
xor ecx, ecx
test edx, edx
jle 0x488d9f
mov bl, byte [0xbf8c9f]
mov bh, byte [0xbf8c9e]
cmp edx, 0x40
jb 0x488d90
mov eax, edx
xor ecx, ecx
and eax, 0x8000003f
jns 0x488d12
dec eax
or eax, 0xffffffc0
inc eax
mov edi, edx
sub edi, eax
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx eax, bh
pshufd xmm2, xmm0, 0
movd xmm0, eax
lea eax, [esi + 0x20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm3, xmm0, 0
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add ecx, 0x40
movaps xmm1, xmm2
xorps xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
xorps xmm1, xmm0
psubb xmm1, xmm3
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
xorps xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [eax - 0x30]
xorps xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [eax - 0x30], xmm0
cmp ecx, edi
jl 0x488d41
cmp ecx, edx
jge 0x488d9f
nop
mov al, byte [ecx + esi]
xor al, bl
sub al, bh
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jl 0x488d90
pop edi
pop esi
pop ebx
ret