joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501761
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xc0], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
mov ecx, dword [eax + 0x28]
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
test ecx, ecx
je 0x4779d9
mov eax, dword [ecx]
push ebx
call dword [eax + 0x10]
push 6
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 1
call fcn.00474e90
test al, al
je 0x477b3f
mov esi, dword [ebx + 0xb8]
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xcc], esi
push 1
push ebx
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 2
call fcn.00474bf0
lea ecx, [ebp - 0x100]
call fcn.00474db0
test al, al
je 0x477b1a
mov ebx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xb8]
nop word [eax + eax]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0xac], 0
mov byte [ebp - 4], 3
lea edx, [ebp - 0xc8]
mov ecx, dword [ebp - 0xf0]
push edx
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x60]
call eax
test al, al
je 0x477abc
mov ecx, dword [ebp - 0xac]
push edi
test ecx, ecx
je 0x477a82
call fcn.0047e830
mov edi, dword [ebp - 0xac]
jmp 0x477a95
lea ecx, [ebp - 0xa8]
call fcn.0047e670
mov edi, eax
mov dword [ebp - 0xac], edi
mov ecx, dword [edi + 0x38]
xor ecx, dword [ebp - 0xc8]
and ecx, 0xfff
xor dword [edi + 0x38], ecx
mov ecx, dword [ebp - 0xc4]
shl ecx, 0x16
xor ecx, dword [edi + 0x38]
and ecx, 0xc00000
xor dword [edi + 0x38], ecx
mov dword [ebp - 0xb0], edi
push edi
push 2
mov byte [ebp - 4], 4
lea edx, [ebp - 0x100]
mov ecx, dword [ebp - 0xf0]
push ecx
mov dword [esp], 0
push esi
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ebx
push edx
call dword [eax + 0x50]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x477afb
call fcn.0047e700
lea ecx, [ebp - 0x100]
call fcn.00474db0
test al, al
jne 0x477a40
mov esi, dword [ebp - 0xbc]
mov ebx, dword [ebp - 0xc0]
mov byte [ebp - 4], 5
test esi, esi
je 0x477b29
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push 6
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00474e90
test al, al
jne 0x4779f2
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x477b4b
call fcn.0047e700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x477b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501761
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xc0], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
mov ecx, dword [eax + 0x28]
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
test ecx, ecx
je 0x477bf9
mov eax, dword [ecx]
push ebx
call dword [eax + 0x10]
push 6
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 1
call fcn.00474e90
test al, al
je 0x477d62
mov esi, dword [ebx + 0xb8]
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xcc], esi
push 1
push ebx
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 2
call fcn.00474bf0
lea ecx, [ebp - 0x100]
call fcn.00474db0
test al, al
je 0x477d3d
mov ebx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xb8]
nop word [eax + eax]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0xac], 0
mov byte [ebp - 4], 3
lea edx, [ebp - 0xc8]
mov ecx, dword [ebp - 0xf0]
push edx
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x60]
call eax
test al, al
je 0x477cdc
mov ecx, dword [ebp - 0xac]
push edi
test ecx, ecx
je 0x477ca2
call fcn.0047e830
mov edi, dword [ebp - 0xac]
jmp 0x477cb5
lea ecx, [ebp - 0xa8]
call fcn.0047e670
mov edi, eax
mov dword [ebp - 0xac], edi
mov ecx, dword [edi + 0x38]
xor ecx, dword [ebp - 0xc8]
and ecx, 0xfff
xor dword [edi + 0x38], ecx
mov ecx, dword [ebp - 0xc4]
shl ecx, 0x16
xor ecx, dword [edi + 0x38]
and ecx, 0xc00000
xor dword [edi + 0x38], ecx
mov dword [ebp - 0xb0], edi
movss xmm0, dword [ebp + 0x14]
lea edx, [ebp - 0x100]
push edi
push 1
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xf0]
push ecx
movss dword [esp], xmm0
push esi
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ebx
push edx
call dword [eax + 0x50]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x477d1e
call fcn.0047e700
lea ecx, [ebp - 0x100]
call fcn.00474db0
test al, al
jne 0x477c60
mov esi, dword [ebp - 0xbc]
mov ebx, dword [ebp - 0xc0]
mov byte [ebp - 4], 5
test esi, esi
je 0x477d4c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push 6
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00474e90
test al, al
jne 0x477c12
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x477d6e
call fcn.0047e700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 0x14
Function at 0x477d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5017ab
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x80], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov ecx, dword [eax + 0x28]
mov eax, dword [edi + 0x34]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
test ecx, ecx
je 0x477e16
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
push 6
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 1
call fcn.00474e90
test al, al
je 0x477ed5
mov ebx, dword [ebp + 0xc]
nop dword [eax]
nop word [eax + eax]
mov esi, dword [edi + 0xb8]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x84], esi
push 1
push edi
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 2
call fcn.00474bf0
lea ecx, [ebp - 0xb8]
call fcn.00474db0
test al, al
je 0x477eb0
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x74]
nop word [eax + eax]
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xa8]
lea edx, [ebp - 0xb8]
push dword [ebp - 0x78]
push esi
mov eax, dword [ecx]
push ebx
push edi
push edx
call dword [eax + 0x54]
lea ecx, [ebp - 0xb8]
call fcn.00474db0
test al, al
jne 0x477e80
mov esi, dword [ebp - 0x7c]
mov edi, dword [ebp - 0x80]
mov byte [ebp - 4], 3
test esi, esi
je 0x477ebf
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push 6
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00474e90
test al, al
jne 0x477e40
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x477ee1
call fcn.0047e700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 0x14
Function at 0x477f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5017fb
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x88], edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp + 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov ecx, dword [eax + 0x28]
mov eax, dword [edi + 0x34]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
test ecx, ecx
je 0x477f95
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
push 5
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 1
call fcn.00474e90
test al, al
je 0x478057
mov ebx, dword [ebp + 0x24]
mov esi, dword [edi + 0xb8]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x8c], esi
push 1
push edi
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
call fcn.00474bf0
lea ecx, [ebp - 0xc0]
call fcn.00474db0
test al, al
je 0x478032
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x74]
nop word [eax + eax]
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xb0]
lea edx, [ebp - 0xc0]
push ebx
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
mov eax, dword [ecx]
push dword [ebp - 0x80]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call dword [eax + 0x58]
lea ecx, [ebp - 0xc0]
call fcn.00474db0
test al, al
jne 0x477ff0
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0x88]
mov byte [ebp - 4], 3
test esi, esi
je 0x478041
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push 5
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00474e90
test al, al
jne 0x477fb1
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x478063
call fcn.0047e700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 0x24
Function at 0x47e3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, ecx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x8c]
lea ebx, [eax + 0x64]
mov dword [esp + 0x18], ecx
mov ecx, eax
mov dword [esp + 0x14], eax
call fcn.0047b230
mov edi, dword [ebp + 8]
mov esi, edi
mov ecx, dword [ebp + 0xc]
xor esi, ecx
mov dword [esp + 0x20], eax
and esi, 1
mov eax, dword [esp + 0x14]
shl esi, 8
cmp byte [eax + 0x9c], 2
je 0x47e504
movd xmm0, ecx
lea eax, [esp + 0x28]
cvtdq2ps xmm0, xmm0
push eax
sub esp, 8
addss xmm0, dword [0x526968]
movss dword [esp + 4], xmm0
movss dword [esp + 0x30], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x526968]
movss dword [esp], xmm0
push ebx
call dword [esp + 0x28]
movss xmm0, dword [esp + 0x38]
add esp, 0x10
movss xmm2, dword [0x526af0]
mov edx, dword [esp + 0x14]
mulss xmm0, xmm2
cmp byte [edx + 0x9c], 1
cvttss2si eax, xmm0
movss xmm0, dword [esp + 0x2c]
mulss xmm0, xmm2
mov dword [esp + 0xc], eax
cvttss2si ecx, xmm0
mov dword [esp + 0x10], ecx
jne 0x47e490
movss xmm1, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.004847c0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x1c]
jmp 0x47e4ad
movss xmm0, dword [ebx]
mulss xmm0, xmm2
cvttss2si edx, xmm0
movss xmm0, dword [ebx + 0xc]
mulss xmm0, xmm2
mov dword [esp + 0x14], edx
cvttss2si edx, xmm0
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x18], edx
test edi, edi
jle 0x47e5bb
mov ebx, dword [ebp + 0x10]
nop
mov edx, eax
call fcn.0047e130
mov ecx, dword [esp + 0x20]
lea ebx, [ebx + 2]
add eax, esi
dec edi
xor esi, 0x100
mov ax, word [ecx + eax*2]
mov ecx, dword [esp + 0x10]
add ecx, dword [esp + 0x18]
mov word [ebx - 2], ax
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
test edi, edi
jg 0x47e4c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
add eax, edi
mov dword [esp + 0x24], eax
cmp edi, eax
jge 0x47e5bb
movss xmm1, dword [0x526968]
mov eax, dword [ebp + 0x10]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x14], eax
addss xmm0, xmm1
movss dword [esp + 0x10], xmm0
lea eax, [esp + 0x28]
push eax
sub esp, 8
movss dword [esp + 4], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movss dword [esp], xmm0
push ebx
call dword [esp + 0x28]
movss xmm0, dword [esp + 0x38]
add esp, 0x10
mulss xmm0, dword [0x526af0]
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2c]
mulss xmm0, dword [0x526af0]
cvttss2si ecx, xmm0
call fcn.0047e130
mov ecx, dword [esp + 0x20]
add eax, esi
movss xmm0, dword [esp + 0x10]
inc edi
movss xmm1, dword [0x526968]
xor esi, 0x100
mov ax, word [ecx + eax*2]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
add ecx, 2
mov dword [esp + 0x14], ecx
cmp edi, dword [esp + 0x24]
jl 0x47e535
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48f7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x48f86b
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x48f814
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048ecf0
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
sub eax, edi
mov dword [ebp + 0xc], eax
movzx esi, byte [eax + edi + 3]
lea edi, [edi + 4]
mov ecx, dword [edi - 4]
inc esi
mov edx, ecx
mov eax, ecx
and edx, 0xff00ff
shr eax, 8
imul edx, esi
and eax, 0xffff00ff
imul eax, esi
shr ecx, 8
and ecx, 0xff00ff
imul ecx, esi
shr edx, 8
xor edx, eax
mov eax, dword [ebp + 0xc]
and edx, 0xff00ff
xor edx, ecx
mov dword [edi - 4], edx
sub ebx, 1
jne 0x48f821
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x48f8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x48f971
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x48f914
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048ecf0
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
sub eax, edi
mov dword [ebp + 0xc], eax
movzx eax, byte [eax + edi + 3]
lea edi, [edi + 4]
mov ecx, dword [edi - 4]
mov esi, 0x100
sub esi, eax
mov edx, ecx
and edx, 0xff00ff
mov eax, ecx
shr eax, 8
imul edx, esi
and eax, 0xffff00ff
imul eax, esi
shr ecx, 8
and ecx, 0xff00ff
imul ecx, esi
shr edx, 8
xor edx, eax
mov eax, dword [ebp + 0xc]
and edx, 0xff00ff
xor edx, ecx
mov dword [edi - 4], edx
sub ebx, 1
jne 0x48f921
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x49e720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
mov edi, ecx
movzx eax, byte [edi + 0x62]
push eax
push dword [edi + 0x5c]
push dword [edi + 0x58]
push str.BitmapShader:___d__d__d
push dword [ebp + 8]
call fcn.00496840
mov eax, dword [edi + 0x3c]
add esp, 0x14
test eax, eax
je 0x49e772
mov eax, dword [eax + 0x1c]
xor edx, edx
cmp word [eax], dx
lea ecx, [eax + 4]
cmove ecx, edx
test ecx, ecx
je 0x49e772
push ecx
push str.___s_
push dword [ebp + 8]
call fcn.004968c0
add esp, 0xc
mov eax, dword [edi + 8]
test eax, eax
je 0x49e869
movq xmm0, qword [eax + 0x20]
sub esp, 0x48
movups xmm1, xmmword [eax + 0x10]
mov dword [esp + 0x54], 0x516d60
movq qword [esp + 0x78], xmm0
movss xmm0, dword [esp + 0x78]
cvtps2pd xmm0, xmm0
movups xmm2, xmmword [eax]
lea eax, [esp + 0x54]
movsd qword [esp + 0x40], xmm0
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xff
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x38], xmm0
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x30], xmm0
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x28], xmm0
xorps xmm0, xmm0
cvtss2sd xmm0, xmm1
movsd qword [esp + 0x20], xmm0
movaps xmm0, xmm2
shufps xmm0, xmm2, 0xff
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
movaps xmm0, xmm2
shufps xmm0, xmm2, 0xaa
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movaps xmm0, xmm2
shufps xmm0, xmm2, 0x55
cvtss2sd xmm0, xmm0
movsd qword [esp + 8], xmm0
xorps xmm0, xmm0
cvtss2sd xmm0, xmm2
movsd qword [esp], xmm0
push str.__8.4f__8.4f__8.4f___8.4f__8.4f__8.4f___8.4f__8.4f__8.4f_
push eax
call fcn.00496840
mov esi, dword [esp + 0x5c]
lea eax, [esi + 4]
push eax
push 0x523ef8
push dword [ebp + 8]
call fcn.004968c0
add esp, 0x5c
cmp word [esi], 0
je 0x49e869
mov eax, 0xffff
add word [esi + 2], ax
jne 0x49e869
push esi
call fcn.004da5c6
add esp, 4
movzx eax, byte [edi + 0xa8]
push dword [eax*4 + 0x516e68]
movzx eax, byte [edi + 0xa7]
push dword [eax*4 + 0x516e68]
push str.___s__s__
push dword [ebp + 8]
call fcn.004968c0
add esp, 0x10
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x49eeb0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502940
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x30]
mov dword [edi], vtable.SkPicturePlayback.0
test eax, eax
je 0x49eeec
push eax
call fcn.004da5c6
add esp, 4
mov eax, dword [edi + 8]
test eax, eax
je 0x49ef23
push 0x472e60
lea esi, [eax - 4]
mov dword [ebp - 4], 0
push dword [esi]
push 0x2c
push eax
call fcn.004d22c3
imul eax, dword [esi], 0x2c
add eax, 4
push eax
push esi
call fcn.004d22b5
add esp, 8
mov dword [ebp - 4], 0xffffffff
push dword [edi + 0x10]
call fcn.004d171b
mov eax, dword [edi + 0x18]
add esp, 4
test eax, eax
je 0x49ef6d
push fcn.0047e700
lea esi, [eax - 4]
mov dword [ebp - 4], 2
push dword [esi]
push 0x3c
push eax
call fcn.004d22c3
mov ecx, dword [esi]
shl ecx, 4
sub ecx, dword [esi]
lea eax, [ecx*4 + 4]
push eax
push esi
call fcn.004d22b5
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 0x20]
test eax, eax
je 0x49efaa
push 0x484fd0
lea esi, [eax - 4]
mov dword [ebp - 4], 3
push dword [esi]
push 0x14
push eax
call fcn.004d22c3
mov eax, dword [esi]
lea eax, [eax + eax*4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.004d22b5
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x49efca
lea edx, [ecx + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
inc eax
cmp eax, 1
jne 0x49efca
mov dword [edx], eax
mov eax, dword [ecx]
push 1
call dword [eax]
xor esi, esi
cmp dword [edi + 0x54], esi
jle 0x49eff6
mov eax, dword [edi + 0x50]
mov ecx, dword [eax + esi*4]
or eax, 0xffffffff
lea edx, [ecx + 4]
lock xadd dword [edx], eax
dec eax
inc eax
cmp eax, 1
jne 0x49eff0
mov dword [edx], eax
mov eax, dword [ecx]
push 1
call dword [eax]
inc esi
cmp esi, dword [edi + 0x54]
jl 0x49efd1
push dword [edi + 0x50]
call fcn.004d171b
mov esi, dword [edi + 0x70]
add esp, 4
test esi, esi
je 0x49f01b
push dword [esi + 4]
call fcn.004d171b
push 8
push esi
call fcn.004d1750
add esp, 0xc
lea ecx, [edi + 0x64]
mov dword [ebp - 4], 4
push 0
mov dword [ecx], vtable.SkRefCntPlayback.0
call fcn.004b0560
lea ecx, [edi + 0x58]
mov dword [ebp - 4], 5
push 0
mov dword [ecx], vtable.SkRefCntPlayback.0
call fcn.004b0560
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a9530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
mov ecx, dword [eax + 0x1c]
imul ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
movsx ebx, word [edi]
mov dword [ebp + 8], ebx
lea esi, [ecx + eax*4]
mov dword [ebp + 0xc], esi
test ebx, ebx
jle 0x4a9601
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4a95df
cmp eax, 0xff
jne 0x4a9581
push ebx
push 0xff000000
push esi
call dword [0x53fa04]
add esp, 0xc
jmp 0x4a95df
mov ecx, eax
mov edi, 0x100
shl ecx, 0x18
sub edi, eax
mov eax, ebx
mov dword [ebp - 4], ecx
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx + eax*4 - 4]
dec eax
mov esi, edx
mov ecx, edx
and esi, 0xff00ff
shr ecx, 8
imul esi, edi
and ecx, 0xffff00ff
shr edx, 8
imul ecx, edi
and edx, 0xff00ff
imul edx, edi
shr esi, 8
xor esi, ecx
and esi, 0xff00ff
xor esi, edx
add esi, dword [ebp - 4]
mov dword [ebx + eax*4], esi
test eax, eax
jg 0x4a9595
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea edi, [edi + ebx*2]
add eax, ebx
mov dword [ebp + 0x14], edi
lea esi, [esi + ebx*4]
mov dword [ebp + 0x10], eax
movsx ebx, word [edi]
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
test ebx, ebx
jg 0x4a9561
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4aafe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov edx, dword [ebp + 0xc]
mov esi, ecx
sar edi, 1
sub edi, 1
js 0x4ab070
nop dword [eax]
movzx eax, word [esi]
mov ecx, eax
and eax, 0xf0f
and ecx, 0xfffff0f0
shl ecx, 0xc
or ecx, eax
imul ecx, edx
add ecx, ebx
shr ecx, 4
mov eax, ecx
shr eax, 0xc
xor eax, ecx
shr ecx, 0xc
and eax, 0xf0f
xor eax, ecx
mov word [esi], ax
movzx eax, word [esi + 2]
mov ecx, eax
and eax, 0xf0f
and ecx, 0xfffff0f0
shl ecx, 0xc
or ecx, eax
imul ecx, edx
add ecx, dword [ebp + 8]
shr ecx, 4
mov eax, ecx
shr eax, 0xc
xor eax, ecx
shr ecx, 0xc
and eax, 0xf0f
xor eax, ecx
mov word [esi + 2], ax
add esi, 4
sub edi, 1
jns 0x4ab000
mov eax, dword [ebp + 0x10]
test al, 1
je 0x4ab0a5
movzx eax, word [esi]
mov ecx, eax
and eax, 0xf0f
and ecx, 0xfffff0f0
shl ecx, 0xc
or ecx, eax
imul ecx, edx
add ecx, ebx
shr ecx, 4
mov eax, ecx
shr eax, 0xc
xor eax, ecx
shr ecx, 0xc
and eax, 0xf0f
xor eax, ecx
mov word [esi], ax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4ab170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [ebp + 0x14], 0
push esi
mov esi, ecx
je 0x4ab2cd
mov al, byte [esi + 0x10]
mov byte [ebp - 1], al
test al, al
je 0x4ab2cd
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [eax + 0x1c]
mov ecx, ebx
mov edi, dword [ebp + 8]
imul ecx, edx
add ecx, dword [eax + 0x10]
lea eax, [ecx + edi*2]
movzx ecx, word [esi + 8]
movzx esi, word [esi + 0xa]
xor edi, edx
and edi, 1
mov dword [ebp + 0xc], ecx
movzx ecx, cx
movzx edx, si
cmove edx, ecx
mov dword [ebp - 8], esi
cmp byte [ebp - 1], 0x10
mov dword [ebp + 8], edi
movzx ecx, dx
jne 0x4ab21b
cmp byte [ebp + 0x14], 0xff
jne 0x4ab21b
mov edi, dword [ebp + 0x10]
sub edi, 1
js 0x4ab2cb
cmp dword [ebp + 8], 0
mov esi, ecx
mov ecx, dword [ebp + 0xc]
movzx edx, cx
mov ecx, dword [ebp - 8]
movzx ecx, cx
cmove edx, ecx
movzx edx, dx
nop dword [eax]
mov word [eax], si
add eax, ebx
sub edi, 1
movzx ecx, si
movzx esi, dx
mov edx, ecx
jns 0x4ab200
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, ecx
mov edi, 0x10
and edx, 0xfffff0f0
and ecx, 0xf0f
shl edx, 0xc
or edx, ecx
movzx ecx, byte [ebp + 0x14]
inc ecx
shr ecx, 4
imul edx, ecx
shr edx, 4
mov esi, edx
and edx, 0xf0f
shr esi, 0xc
and esi, 0xff0f0
or esi, edx
mov edx, esi
and edx, 0xf
mov ecx, edx
shr ecx, 3
sub edi, ecx
mov ecx, esi
and ecx, 0xfffff0f0
and esi, 0xf0f
shl ecx, 0xc
sub edi, edx
or ecx, esi
mov esi, dword [ebp + 0x10]
mov edx, ecx
shl edx, 4
or edx, ecx
sub esi, 1
mov dword [ebp + 0x14], edx
js 0x4ab2cb
nop word [eax + eax]
movzx ecx, word [eax]
mov edx, ecx
and ecx, 0xf0f
and edx, 0xfffff0f0
shl edx, 0xc
or edx, ecx
imul edx, edi
add edx, dword [ebp + 0x14]
shr edx, 4
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
shr edx, 0xc
and ecx, 0xf0f
xor ecx, edx
mov word [eax], cx
add eax, ebx
sub esi, 1
jns 0x4ab290
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10