joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a020
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 prga

Disassembly:
mov al, byte [0x4f3d3c]
sub esp, 0xd8
test al, al
jne 0x41a038
mov al, 1
add esp, 0xd8
ret
mov al, byte [0x7984c0]
push edi
push esi
push ebp
test al, al
push ebx
mov byte [0x4f3c9c], 1
jbe 0x41a068
xor ecx, ecx
mov edi, 0x4f39d0
mov cl, al
mov eax, 0x5050505
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 5
mov dword [esp + 0x10], 0
mov byte [0x4db9e4], al
mov dword [esp + 0x14], eax
mov eax, dword [0x4f40e8]
lea edx, [esp + 0x10]
push edx
push 0x3e8
mov ecx, dword [eax]
push 0x4f3ad8
push eax
mov byte [0x4f40c4], 0
mov byte [0x4f40c8], 0
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
xor bl, bl
mov dword [0x4f40c0], eax
mov al, byte [0x7984c0]
test al, al
mov byte [esp + 0x18], bl
jbe 0x41a177
mov eax, dword [esp + 0x18]
and eax, 0xff
lea esi, [eax + eax*4]
shl esi, 3
lea ecx, [esi + 0x4f2898]
push ecx
push 0x4f1018
call fcn.004bcb20
add esp, 8
test eax, eax
je 0x41a156
mov eax, dword [esi + 0x4f28b4]
xor ecx, ecx
mov edx, eax
mov dword [esp + 0x1c], eax
mov cl, byte [esp + 0x1e]
shr edx, 0x18
push edx
xor edx, edx
mov dl, ah
push ecx
and eax, 0xff
push edx
push eax
lea eax, [esp + 0x30]
push str._d._d._d._d
push eax
call fcn.004b0670
mov eax, dword [0x4f40e8]
add esp, 0x18
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
lea edx, [esp + 0x24]
push 0x3e8
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
mov byte [esi + 0x4f28bc], 0
mov dword [esi + 0x4f28b8], eax
jmp 0x41a164
mov byte [esi + 0x4f28bd], 1
mov byte [esi + 0x4f28bc], 1
mov al, byte [0x7984c0]
inc bl
cmp bl, al
mov byte [esp + 0x18], bl
jb 0x41a0ce
call edi
mov esi, eax
mov eax, dword [0x4f40e4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [0x4f40e8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov cl, byte [0x7984c0]
xor bl, bl
test cl, cl
jbe 0x41a1b5
xor edx, edx
mov eax, 0x4f28bc
mov dl, cl
mov ecx, edx
cmp byte [eax], 0
jne 0x41a1af
mov bl, 1
add eax, 0x28
dec ecx
jne 0x41a1a8
mov al, byte [0x4f40c8]
test al, al
jne 0x41a1c0
mov bl, 1
test bl, bl
je 0x41a1de
call edi
mov ecx, esi
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x1388
jle 0x41a1da
xor bl, bl
test bl, bl
jne 0x41a17b
mov cl, byte [0x7984c0]
test cl, cl
jbe 0x41a1ff
xor edx, edx
mov eax, 0x4f28b8
mov dl, cl
mov ecx, edx
mov dword [eax], 0
add eax, 0x28
dec ecx
jne 0x41a1f3
push 0x7d0
call ebp
mov eax, dword [esp + 0x14]
mov dword [0x4f40c0], 0
dec eax
mov dword [esp + 0x14], eax
jne 0x41a08a
mov al, byte [0x4f40c4]
pop ebx
pop ebp
pop esi
mov byte [0x4f3c9c], 0
pop edi
add esp, 0xd8
ret
Function at 0x42b590
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x1f4
lea eax, [esp + 0x200]
lea edx, [esp + 0x64]
push ebx
push esi
push edi
push eax
push ecx
push edx
call fcn.004b15b0
mov eax, dword [0x5173f4]
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
push str.___gGameTicks___d__
push ecx
call fcn.004b0670
mov al, byte [0x513480]
add esp, 0xc
test al, 1
je 0x42b5d9
call fcn.004a4530
mov al, byte [0x4eb00c]
test al, al
je 0x42b5e7
call fcn.0046f490
call fcn.0044f6f0
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x70]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x70]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call esi
push 0x4db9f0
call esi
mov ecx, dword [esp + 0x204]
push 0
lea edx, [esp + 0x74]
push ecx
push edx
push 0
call fcn.008d7418
nop
mov al, byte [0x4eb008]
test al, al
je 0x42b661
push 1
call fcn.004b18c0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x1f4
ret
call fcn.004b1870
pop edi
pop esi
pop ebx
add esp, 0x1f4
ret

Function at 0x42b670
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x1f4
lea eax, [esp + 0x200]
lea edx, [esp + 0x64]
push ebx
push esi
push edi
push eax
push ecx
push edx
call fcn.004b15b0
mov eax, dword [0x5173f4]
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
push str.___gGameTicks___d__
push ecx
call fcn.004b0670
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x70]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x70]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call esi
push 0x4db9f0
call esi
mov al, byte [0x6b8864]
test al, al
je 0x42b725
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str.WARNING_
push 0x512d78
call esi
add esp, 8
lea ecx, [esp + 0x70]
push ecx
push 0x4dc67c
push 0x513098
call esi
add esp, 0xc
mov byte [0x513484], 1
pop edi
pop esi
pop ebx
add esp, 0x1f4
ret
Function at 0x42b800
Capabilities:
Get disk information

Disassembly:
sub esp, 0x208
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
mov edi, ebp
xor bl, bl
push 0x3a
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call fcn.004b19e0
lea edx, [esp + 0x19]
add esp, 8
cmp eax, edx
jne 0x42b863
lea eax, [esp + 0x10]
mov byte [esp + 0x12], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x42b872
jmp 0x42b870
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x42b872
mov bl, 1
test bl, bl
mov byte [0x797e2c], 0
jne 0x42b893
mov al, byte [0x51378c]
test al, al
jne 0x42b893
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
lea ecx, [esp + 0xd8]
mov bl, 1
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x42b8ab
xor bl, bl
test bl, bl
je 0x42b8b6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov byte [0x797e2c], bl
mov al, bl
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x42b8d0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0
push 0x4de5e4
push eax
call fcn.0042ba50
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x42ba4a
push edi
push esi
push 0x96
push 0x513488
push ebx
call fcn.0042bbe0
add esp, 0xc
test al, al
jne 0x42b91a
push str.Cannot_read_res_path_for_gRES_PATH
push str.GAME_SET_RES_PATH
call fcn.0042b590
add esp, 8
push 0xa
push 0x513488
call fcn.004b19e0
add esp, 8
test eax, eax
je 0x42b930
mov byte [eax], 0
push 0x96
push 0x513520
push ebx
call fcn.0042bbe0
add esp, 0xc
test al, al
jne 0x42b96c
mov edi, 0x513488
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x513520
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 0x513520
call fcn.004b19e0
add esp, 8
test eax, eax
je 0x42b982
mov byte [eax], 0
push 0x96
push 0x5135b8
push ebx
call fcn.0042bbe0
add esp, 0xc
test al, al
jne 0x42b9ab
push str.Cannot_read_res_path_for_gMUSIC_RES_PATH
push str.GAME_SET_RES_PATH
call fcn.0042b590
add esp, 8
push 0xa
push 0x5135b8
call fcn.004b19e0
add esp, 8
test eax, eax
je 0x42b9c1
mov byte [eax], 0
push 0x96
push 0x513650
push ebx
call fcn.0042bbe0
add esp, 0xc
test al, al
jne 0x42b9ea
push str.Cannot_read_res_path_for_gMISSIONS_FOR_ONE_PLAYER_RES_PATH
push str.GAME_SET_RES_PATH
call fcn.0042b590
add esp, 8
push 0xa
push 0x513650
call fcn.004b19e0
add esp, 8
test eax, eax
je 0x42ba00
mov byte [eax], 0
push 0x96
push 0x5136e8
push ebx
jmp 0x8d3cd0
pop ebx
ret
Function at 0x4318f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor eax, eax
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov byte [ebx], al
inc ebx
inc eax
cmp eax, 0x100
jb 0x4318fd
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x1c], 1
and ebp, 0xff
cmp ebp, 1
jbe 0x43199c
mov al, byte [esp + 0x24]
mov dl, byte [esp + 0x1c]
mov ecx, dword [esp + 0x20]
sub al, dl
dec al
mov dword [esp + 0x10], 0x100
mov byte [esp + 0x14], al
lea esi, [ecx + 1]
mov edi, dword [esp + 0x14]
and edi, 0xff
xor eax, eax
mov edx, dword [esp + 0x20]
mov al, byte [esi + 1]
push 1
imul eax, edi
push 0
push 0
push edx
cdq
idiv ebp
push eax
xor eax, eax
mov al, byte [esi]
imul eax, edi
cdq
idiv ebp
push eax
xor eax, eax
mov al, byte [esi - 1]
imul eax, edi
cdq
idiv ebp
push eax
call fcn.00431c40
mov byte [ebx], al
mov eax, dword [esp + 0x2c]
add esp, 0x1c
inc ebx
add esi, 3
dec eax
mov dword [esp + 0x10], eax
jne 0x431948
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, ebp
mov dword [esp + 0x1c], eax
jb 0x43191f
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4319b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov byte [ebp], al
inc ebp
inc eax
cmp eax, 0x100
jb 0x4319bd
mov ebx, dword [esp + 0x24]
mov edi, 1
and ebx, 0xff
cmp ebx, edi
jbe 0x431a8e
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0x100
lea esi, [eax + 2]
mov dl, byte [esi - 1]
mov al, byte [esi]
mov byte [esp + 0x24], dl
mov edx, dword [esp + 0x20]
push 1
push 0
mov byte [esp + 0x24], al
push 0
push edx
mov edx, dword [esp + 0x2c]
and edx, 0xff
mov eax, 0x3f
sub eax, edx
xor edx, edx
imul eax, edi
div ebx
mov dl, byte [esp + 0x2c]
mov cl, byte [esi - 2]
mov byte [esp + 0x24], cl
add al, dl
mov edx, dword [esp + 0x34]
push eax
and edx, 0xff
mov eax, 0x3f
sub eax, edx
xor edx, edx
imul eax, edi
div ebx
mov dl, byte [esp + 0x38]
add al, dl
mov edx, dword [esp + 0x28]
push eax
and edx, 0xff
mov eax, 0x3f
sub eax, edx
xor edx, edx
imul eax, edi
div ebx
add al, cl
push eax
call fcn.00431c40
mov byte [ebp], al
mov eax, dword [esp + 0x2c]
add esp, 0x1c
inc ebp
add esi, 3
dec eax
mov dword [esp + 0x10], eax
jne 0x4319ef
inc edi
cmp edi, ebx
jb 0x4319e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4414d0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x128
mov al, byte [0x798628]
push ebx
push esi
push edi
mov edi, dword [esp + 0x140]
mov byte [esp + 0x18], al
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov bl, byte [esp + 0x13c]
lea edx, [esp + 0x19]
not ecx
sub edi, ecx
mov dword [esp + 0xc], 0xd8
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x10], bl
shr ecx, 2
mov dword [esp + 0x14], 0x28f
push 0x4f0f18
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x4db9b0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x140]
push ecx
call fcn.0042ba50
mov esi, eax
add esp, 0xc
test esi, esi
je 0x441897
jmp loc.008d8750
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x128
ret
Function at 0x448550
Capabilities:
Print debug messages
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x79759c]
sub esp, 0x2c8
mov byte [0x4dfaf4], 1
mov byte [0x5179d0], 0
push ebx
push ebp
push esi
push edi
mov byte [0x6b9880], 0
mov byte [0x5162b0], 1
call fcn.00470e20
mov al, byte [0x7984d4]
test al, al
je 0x4485b0
mov eax, dword [0x4eb01c]
mov ecx, dword [0x4eb018]
cmp ecx, eax
je 0x4485a9
mov ecx, dword [0x79759c]
mov dword [0x4eb018], eax
call fcn.00474820
mov byte [0x7984d4], 0
mov al, byte [0x797e1c]
xor ebp, ebp
test al, al
mov byte [0x5179d0], 0
mov byte [0x4dfaf4], 1
jne 0x4485dc
cmp dword [0x4eb018], 8
jne 0x4485d7
call fcn.0046aa00
call fcn.0044acc0
mov byte [0x4f3d24], 0
mov byte [0x4f3d28], 0
mov byte [0x6b8274], 0
mov byte [0x6b8278], 0
mov byte [0x6b63c8], 0
mov byte [0x6b7050], 1
mov byte [0x5179bc], 0
mov byte [0x4dfafc], 1
call fcn.008d89a5
mov al, byte [0x797e1c]
mov dword [0x5173f4], ebp
test al, al
mov byte [0x517568], 0
jne 0x448668
mov eax, dword [0x4eb018]
mov ecx, dword [0x4eb028]
push str.ToolTip
push eax
push 0x30
push ecx
call fcn.0042ef90
mov dword [0x5175c8], eax
mov al, byte [0x797e1c]
add esp, 0x10
test al, al
jne 0x448668
call fcn.00460ec0
call fcn.00466140
call fcn.00454e00
mov eax, dword [0x5178b4]
cmp eax, ebp
jne 0x448697
mov edx, dword [0x4eb018]
mov eax, dword [0x4eb02c]
mov ecx, dword [0x4eb028]
push str.GameLoop___gBackBuf
push edx
push eax
push ecx
call fcn.0042ef90
add esp, 0x10
mov dword [0x5178b4], eax
push ebp
push ebp
push eax
call fcn.00430860
add esp, 0xc
mov byte [0x7984bc], 1
call fcn.004470a0
jmp 0x8d3f70

Function at 0x44c6d0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x39c
mov ecx, 0x320
or eax, 0xffffffff
push ebx
push ebp
push esi
push edi
mov edi, 0x516770
rep stosd dword es:[edi], eax
mov al, byte [0x797e1c]
test al, al
jne 0x44c6ff
push 0x5166a0
call fcn.00462d10
add esp, 4
mov eax, dword [0x797e34]
test eax, eax
jne 0x44c70f
push 0x513650
jmp 0x44c714
push 0x5136e8
mov esi, dword [esp + 0x3b4]
push 0x4db9b4
push esi
call fcn.0042ba50
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x44c741
push str.Cannot_open_file
push str.LoadMapData
call fcn.0042b590
add esp, 8
push ebp
push 1
lea eax, [esp + 0x1c]
push 2
push eax
call fcn.0042bb60
mov ecx, dword [esp + 0x24]
add esp, 0x10
lea edx, [esp + 0x18]
and ecx, 0xffff
push ebp
push 1
push 2
push edx
mov dword [0x517de8], ecx
call fcn.0042bb60
mov eax, dword [esp + 0x28]
mov edx, dword [0x517de8]
and eax, 0xffff
add esp, 0x10
jmp 0x8d1670
Function at 0x44e800
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push 0x751
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
xor edx, edx
add esp, 8
div dword [0x517de8]
push 0x752
push str.C:MsDevProjectsJuly2000codemap.cpp
mov byte [esi], dl
call fcn.00448460
xor edx, edx
add esp, 8
div dword [0x517dec]
xor eax, eax
mov byte [edi], dl
mov al, byte [esi]
and edx, 0xff
mov edx, dword [edx*4 + 0x547df0]
add edx, eax
lea ecx, [edx + edx*2]
mov edx, dword [ecx*4 + 0x517df4]
and edx, 0x73f8
cmp edx, 0x6000
jne 0x44e80a
push 0x755
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
xor edx, edx
mov ecx, 0x64
div ecx
mov ecx, dword [esp + 0x1c]
add esp, 8
xor al, al
mov byte [esp + 0x10], al
mov byte [ecx], 0xff
cmp byte [ecx], 0xff
jne 0x44e8b8
mov esi, dword [esp + 0x10]
and esi, 0xff
cmp byte [esi + str.2AFK_d], dl
jbe 0x44e8ae
mov byte [ecx], al
inc al
cmp al, 0x64
mov byte [esp + 0x10], al
jb 0x44e895
cmp byte [ecx], 0xff
jne 0x44e8cf
push str.Creating_illegal_crate
push str.Map.cpp
call fcn.0042b590
add esp, 8
pop edi
pop esi
ret
Function at 0x44ea70
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov byte [esp + 0x13], bl
xor ebp, ebp
mov esi, 0x517b9a
cmp byte [esi + 1], 1
jne 0x44ec20
cmp byte [esi], 6
jae 0x44ea97
inc byte [esp + 0x13]
mov eax, dword [esi + 6]
dec eax
mov dword [esi + 6], eax
jne 0x44ec20
mov al, byte [esi]
cmp al, 7
jb 0x44ebf4
cmp al, 9
jbe 0x44eb2b
cmp al, 0xa
jne 0x44ebf4
mov cl, byte [esi - 1]
mov dl, byte [esi - 2]
mov eax, ecx
mov edi, edx
and eax, 0xff
and edi, 0xff
mov eax, dword [eax*4 + 0x547df0]
add eax, edi
lea eax, [eax + eax*2]
test dword [eax*4 + 0x517df4], 0x7003f8
jne 0x44eb02
push 6
push ecx
push edx
call fcn.0044ef10
add esp, 0xc
push ebp
call fcn.0044f110
add esp, 4
jmp 0x44ec20
push 0x7f9
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
xor edx, edx
mov ecx, 0x3e8
div ecx
add esp, 8
add edx, 0x7d0
mov dword [esi + 6], edx
jmp 0x44ec20
xor edx, edx
xor eax, eax
mov dl, byte [esi - 1]
mov al, byte [esi - 2]
mov ecx, eax
mov eax, dword [edx*4 + 0x547df0]
add eax, ecx
lea edx, [eax + eax*2]
test dword [edx*4 + 0x517df4], 0x7003f8
jne 0x44ebce
mov cl, byte [esi + 2]
inc cl
mov byte [esi + 2], cl
mov al, byte [esi]
inc al
mov byte [esi], al
mov al, byte [0x5173f4]
mov byte [esp + 0x14], al
mov edi, dword [esp + 0x14]
mov eax, edi
and eax, 0xff
inc eax
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
sub eax, edx
mov byte [esp + 0x14], al
mov edi, dword [esp + 0x14]
push edi
call fcn.004a4660
mov cl, byte [eax + 0x24250]
add esp, 4
cmp cl, bl
je 0x44eb6b
mov al, byte [0x6d6117]
cmp al, 0xff
je 0x44ebce
movzx dx, byte [esi - 2]
movzx cx, byte [esi - 1]
push ebx
push ebx
push ebx
push ebx
shl edx, 5
shl ecx, 5
push ebx
add edx, 0x10
push ecx
push edx
push eax
mov al, byte [0x5173f4]
and al, 7
push eax
call fcn.00456df0
add esp, 0x24
push 0x7ea
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
xor edx, edx
mov ecx, 0x3e8
div ecx
add esp, 8
add edx, 0x7d0
mov dword [esi + 6], edx
jmp 0x44ec20
xor edx, edx
xor eax, eax
mov byte [esi + 1], bl
mov dl, byte [esi - 1]
mov al, byte [esi - 2]
mov ecx, eax
mov eax, dword [edx*4 + 0x547df0]
add eax, ecx
lea eax, [eax + eax*2]
mov ecx, dword [eax*4 + 0x517df4]
and ch, 0xef
mov dword [eax*4 + 0x517df4], ecx
add esi, 0xc
inc ebp
cmp esi, 0x517d02
jb 0x44ea84
mov dl, byte [esp + 0x13]
mov al, byte [0x548048]
cmp dl, al
jae 0x44ec42
call fcn.0044e7c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x44ef10
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push edi
mov edi, dword [esp + 0x24]
and edi, 0xff
mov byte [esp + 0x24], 0
mov eax, edi
mov dword [esp + 8], edi
imul eax, edi
shl eax, 1
je 0x44f0e1
mov ecx, dword [esp + 0x1c]
push esi
and ecx, 0xff
push ebp
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
and ecx, 0xff
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
jmp 0x44ef61
mov edi, dword [esp + 0x14]
push 0x8bb
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
add esp, 8
mov esi, eax
and esi, 0x1f
push 0x8bc
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
add esp, 8
mov ebp, eax
and ebp, 0xf
push 0x8bd
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
xor edx, edx
mov ecx, dword [esp + 0x28]
div edi
shl esi, 9
add esp, 8
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
and eax, 0xff
add esi, eax
shl esi, 2
mov eax, dword [esi + 0x6e9840]
cdq
and edx, 0x7ff
add eax, edx
mov edx, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [esi + 0x704a98]
sar edi, 0xb
add edi, edx
cdq
and edx, 0x7ff
add eax, edx
mov esi, eax
sar esi, 0xb
add esi, ecx
test edi, edi
jle 0x44f0cf
cmp edi, dword [0x517de8]
jge 0x44f0cf
test esi, esi
jle 0x44f0cf
cmp esi, dword [0x517dec]
jge 0x44f0cf
mov eax, dword [esi*4 + 0x547df0]
add eax, edi
lea ecx, [eax + eax*2]
test dword [ecx*4 + 0x517df4], 0x710000
je 0x44f0cf
mov eax, ebx
and eax, 0xff
inc eax
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
sub eax, edx
mov byte [esp + 0x30], al
mov ebx, dword [esp + 0x30]
push ebx
call fcn.004a4660
mov cl, byte [eax + 0x24250]
add esp, 4
test cl, cl
je 0x44f033
push 0xffffffffffffffff
push 0xffff
push 0x8d5
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
and eax, 0x1f
add esp, 8
shl esi, 5
add eax, esi
push eax
push 0x8d4
push str.C:MsDevProjectsJuly2000codemap.cpp
call fcn.00448460
movzx dx, byte [esp + 0x40]
and eax, 0x1f
add esp, 8
shl edi, 5
add eax, edi
mov cl, byte [0x6d610a]
push eax
movzx ax, byte [esp + 0x38]
shl edx, 5
shl eax, 5
add edx, 0x10
add eax, 0x10
push edx
push eax
push 0xffff
push ebp
push ecx
push ebx
call fcn.00456a30
add esp, 0x28
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x44ef5d
pop ebx
pop ebp
pop esi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
push str.S_SPICEMOUND
call fcn.0048dd90
add esp, 4
push eax
call fcn.0046f540
add esp, 0xc
pop edi
add esp, 0x14
ret
Function at 0x44f6f0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x7984c8]
sub esp, 0x64
test al, al
je 0x44f75e
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, 0x548084
cmp byte [esi - 2], 1
jne 0x44f74f
mov eax, dword [esi]
lea ecx, [esi - 0x34]
push eax
push ecx
lea edx, [esp + 0x18]
push str.Freeing_memory:__s___d__n
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call ebp
mov ecx, dword [esi + 4]
mov edx, dword [0x6b63b0]
push ecx
push 0
push edx
call ebx
dec dword [0x6b63b8]
add esi, 0x3c
cmp esi, 0x6b63e4
jb 0x44f717
pop ebx
pop ebp
pop esi
pop edi
add esp, 0x64
ret

Function at 0x455870
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
and ebp, 0xff
push edi
mov dword [esp + 0x10], ebp
shl ebp, 8
mov al, byte [ebp + 0x77e27d]
cmp al, 2
je 0x45590a
cmp al, 8
je 0x45590a
cmp al, 9
je 0x45590a
cmp al, 0xa
je 0x45590a
cmp al, 5
je 0x45590a
mov edi, dword [esp + 0x20]
mov eax, dword [0x517de8]
and edi, 0xff
cmp edi, eax
jge 0x4558c6
mov esi, dword [esp + 0x24]
mov eax, dword [0x517dec]
and esi, 0xff
cmp esi, eax
jl 0x4558e4
mov esi, dword [esp + 0x24]
and esi, 0xff
push esi
push edi
push str.Unit_added_at__d__d__outside_map_area
push str.ModelAddUnit
call fcn.0042b590
add esp, 0x10
mov esi, dword [esi*4 + 0x547df0]
add esi, edi
lea eax, [esi + esi*2]
mov eax, dword [eax*4 + 0x517df4]
test al, 0x10
je 0x45590a
mov cl, byte [esp + 0x18]
and eax, 7
cmp al, cl
jne 0x455fb3
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004a4660
mov edi, eax
xor ebx, ebx
add esp, 4
cmp byte [edi + 0x24250], bl
je 0x455fb3
mov ecx, edi
call fcn.0046bd40
mov esi, eax
cmp esi, ebx
je 0x455f90
jmp 0x8d5880
push 0xffffffffffffffff
push 1
push str.ReachedUnitLimit
call fcn.0048dc10
add esp, 4
push eax
call fcn.0048dcc0
add esp, 8
push eax
call fcn.00425720
add esp, 8
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
pop ecx
ret

Function at 0x4563b0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x24
push ebx
push ebp
push esi
push edi
push eax
call fcn.004a4660
mov edi, eax
add esp, 4
mov al, byte [edi + 0x24250]
test al, al
je 0x4569d1
mov ecx, edi
call fcn.0046bd40
mov esi, eax
test esi, esi
je 0x4569ae
jmp loc.008d58c0
push 0xffffffffffffffff
push 1
push str.ReachedUnitLimit
call fcn.0048dc10
add esp, 4
push eax
call fcn.0048dcc0
add esp, 8
push eax
call fcn.00425720
add esp, 8
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0x24
ret
Function at 0x45abb0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x6b98ac]
test al, al
je 0x45ac2d
mov eax, dword [0x6b9900]
push esi
test eax, eax
jne 0x45abca
push 0x4e3b64
jmp 0x45abcf
push 0x4e3b60
push str.network.log
call fcn.004b0fd0
mov esi, dword [esp + 0x10]
add esp, 8
test eax, eax
mov dword [0x6b9900], eax
je 0x45ac25
push 0
push 4
push 0
push eax
call fcn.004b2070
mov eax, dword [0x6b9900]
add esp, 0x10
push esi
push eax
call fcn.004b2030
mov ecx, dword [0x6b9900]
add esp, 8
push ecx
call fcn.004b1ee0
mov edx, dword [0x6b9900]
add esp, 4
push edx
call fcn.004b0ff0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
ret