joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4287b0
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x492e33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push ebp
mov ebp, dword [esp + 0xa8]
push esi
xor ebx, ebx
mov esi, ecx
cmp esi, ebx
push edi
mov dword [0x4edfdc], ebx
je 0x428913
push ebp
mov byte [0x4edfe4], bl
mov byte [0x4edfe5], bl
mov byte [0x4edfe6], bl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
lea eax, [esp + 0x38]
push eax
mov dword [0x4a28f0], 2
call fcn.0042a070
push 0x2604
mov dword [esp + 0xac], ebx
call fcn.00459d0c
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0xa8], 1
je 0x428842
push eax
call fcn.0042ca60
jmp 0x428844
xor eax, eax
mov esi, dword [esp + 0xb4]
mov byte [esp + 0xa8], bl
lea edi, [eax + 0x25dc]
mov ecx, 0xa
mov byte [eax + 0x1e60], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov dword [0x4edfdc], eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x428870
sub ecx, esi
push ecx
push ebp
mov ecx, eax
call fcn.00404090
lea ecx, [esp + 0x34]
push ecx
call fcn.0042e9f0
push 6
mov esi, 0xf
push str.SBDVER
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00404090
cmp dword [esp + 0x2c], 0x10
jb 0x4288c3
mov edx, dword [esp + 0x18]
push edx
call fcn.00459ea4
add esp, 4
mov eax, dword [0x4edfdc]
sub dword [0x4a28f0], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
movzx ecx, byte [eax + 0x21c0]
mov dword [0x4e2970], ecx
mov edx, dword [eax + 0x1f68]
mov dword [0x4e2974], edx
mov eax, dword [eax + 0x1f6c]
lea ecx, [esp + 0x34]
mov dword [0x4e2978], eax
mov dword [esp + 0xa8], 0xffffffff
call fcn.0042a0e0
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x9c
ret
Function at 0x429fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, esi
push edi
xor eax, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x429fe8
sub ecx, edi
pop edi
je 0x42a01c
jmp 0x42a000
movzx edx, byte [esi + ecx - 1]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4ec8a8]
sub ecx, 1
jne 0x42a000
ret

Function at 0x42a190
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x400
cmp dword [esi + 0x64], 0
je 0x42a1df
mov ecx, dword [esp + 0x404]
lea eax, [esp + 0x408]
push eax
push ecx
lea edx, [esp + 8]
push edx
call fcn.0045b58b
lea eax, [esp + 0xc]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42a1c0
mov ecx, dword [esi + 0x64]
push ecx
sub eax, edx
push eax
lea edx, [esp + 8]
push 1
push edx
call fcn.0045be72
add esp, 0x10
add esp, 0x400
ret
Function at 0x42b85a
Capabilities:
Encode data using xor
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4929b8
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jle 0x42b88b
lea esp, [esp]
mov eax, dword [esi + 0x50]
mov eax, dword [eax + edi*4]
cmp eax, ebx
je 0x42b883
push eax
call fcn.00459ea4
add esp, 4
add edi, 1
cmp edi, dword [esi + 0x48]
jl 0x42b870
mov edi, dword [esp + 0x98]
push edi
mov ecx, esi
mov dword [esi + 0x48], ebx
call fcn.004314f0
push 7
push str.SEEDNUM
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00404090
lea eax, [esp + 0x30]
mov ecx, edi
call fcn.0042a5d0
cmp eax, ebx
je 0x42b8d5
mov ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
jmp 0x42b8d9
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x48], 0x10
jb 0x42b8ed
mov edx, dword [esp + 0x34]
push edx
call fcn.00459ea4
add esp, 4
xor ebp, ebp
cmp dword [esp + 0x10], ebx
jle 0x42ba30
lea esp, [esp]
push 0x38
call fcn.00459d0c
add esp, 4
cmp eax, ebx
je 0x42b920
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
push 4
push str.SEED
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00404090
push ebp
lea eax, [esp + 0x6c]
push str.:_08d
push eax
mov dword [esp + 0x9c], ebx
call fcn.0045b0bf
lea ecx, [esp + 0x20]
push ecx
lea edi, [esp + 0x78]
lea esi, [esp + 0x5c]
call fcn.0042aac0
add esp, 0x10
cmp dword [eax + 0x18], 0x10
jb 0x42b977
mov esi, dword [eax + 4]
jmp 0x42b97a
lea esi, [eax + 4]
mov eax, esi
xor ecx, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x42b981
sub eax, edi
je 0x42b9ac
mov edi, edi
movzx edx, byte [esi + eax - 1]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4ec8a8]
sub eax, 1
jne 0x42b990
mov edx, dword [esp + 0x98]
mov esi, dword [edx + 0x14]
xor eax, eax
cmp esi, ebx
jle 0x42b9d0
mov edx, dword [edx + 0x1c]
nop
mov edi, dword [edx]
cmp dword [edi], ecx
je 0x42b9d0
add eax, 1
add edx, 4
cmp eax, esi
jl 0x42b9c0
mov edi, 0x10
cmp dword [esp + 0x64], edi
jb 0x42b9e8
mov eax, dword [esp + 0x50]
push eax
call fcn.00459ea4
add esp, 4
mov esi, 0xf
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
jb 0x42ba17
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00459ea4
add esp, 4
add ebp, 1
cmp ebp, dword [esp + 0x10]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jl 0x42b900
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x84
ret 4
Function at 0x42c080
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0x497cf8
push str.game.dat
call fcn.0045bfb8
xor ebx, ebx
add esp, 8
cmp eax, ebx
je 0x42c0c4
push eax
call fcn.0045bc97
add esp, 4
push 0x4ee128
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0042bfe0
cmp eax, ebx
je 0x42c0ce
add dword [eax], 1
jmp 0x42c1c2
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x497cf8
push str.game.dat
call fcn.0045bfb8
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x42c106
push ebx
push ebx
push esi
call fcn.0045c052
push esi
push 0x10
lea eax, [esp + 0x24]
push 1
push eax
call fcn.0045c579
push esi
call fcn.0045bc97
add esp, 0x20
push 0x34
call fcn.00459d0c
add esp, 4
cmp eax, ebx
je 0x42c12d
mov dword [eax + 0x1c], 0xf
mov dword [eax + 0x18], ebx
mov byte [eax + 8], bl
mov dword [eax], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov ebp, eax
jmp 0x42c12f
xor ebp, ebp
mov eax, str.game.dat
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42c137
sub eax, edx
push eax
push str.game.dat
lea ecx, [ebp + 4]
call fcn.00404090
mov esi, str.game.dat
call fcn.00429fe0
mov dword [ebp + 0x20], eax
mov ecx, dword [esp + 0x14]
mov dword [ebp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov ecx, edx
mov dword [ebp + 0x2c], edx
mov eax, dword [esp + 0x1c]
shl ecx, 6
push ecx
mov dword [ebp + 0x28], eax
mov dword [ebp], ebx
call fcn.0045a843
mov ecx, eax
mov eax, dword [ebp + 0x2c]
push 0x10
mov dword [ebp + 0x30], ecx
push ecx
shl eax, 6
mov ecx, esi
call fcn.0042c7e0
mov eax, dword [0x4ee08c]
add esp, 0xc
cmp dword [0x4ee088], eax
jl 0x42c1ad
lea edi, [eax + eax]
call fcn.0042c8c0
mov eax, dword [0x4ee088]
mov edx, dword [0x4ee090]
mov dword [edx + eax*4], ebp
add dword [0x4ee088], 1
push 0x4ee128
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret
Function at 0x42c310
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
or esi, 0xffffffff
push 0x4ee128
mov ebx, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
cmp dword [0x4ee088], ebp
jle 0x42c3c4
jmp 0x42c340
mov eax, dword [0x4ee090]
mov edi, dword [eax + ebp*4]
mov eax, ebx
xor ecx, ecx
lea esi, [eax + 1]
nop
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x42c350
sub eax, esi
je 0x42c37c
lea ecx, [ecx]
movzx edx, byte [ebx + eax - 1]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4ec8a8]
sub eax, 1
jne 0x42c360
mov edx, dword [edi + 0x2c]
xor eax, eax
test edx, edx
jle 0x42c396
mov edi, dword [edi + 0x30]
cmp dword [edi], ecx
je 0x42c3a3
add eax, 1
add edi, 0x40
cmp eax, edx
jl 0x42c388
add ebp, 1
cmp ebp, dword [0x4ee088]
jl 0x42c340
jmp 0x42c3c0
mov eax, dword [0x4ee090]
mov eax, dword [eax + ebp*4]
test eax, eax
je 0x42c3c0
mov ecx, dword [esp + 0x18]
push ecx
push eax
call fcn.0042c2a0
mov edx, dword [eax]
mov dword [esp + 0x10], edx
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4ee128
call edi
cmp esi, 0xffffffff
je 0x42c42a
cmp byte [esp + 0x1c], 0
jne 0x42c42a
lea ecx, [ecx]
xor bl, bl
cmp esi, 0xffffffff
je 0x42c42a
push 0x4ee128
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4ee0d4]
xor eax, eax
test ecx, ecx
jle 0x42c413
mov edx, dword [0x4ee0dc]
mov ebp, dword [edx + eax*4]
cmp dword [ebp], esi
je 0x42c415
add eax, 1
cmp eax, ecx
jl 0x42c404
mov bl, 1
push 0x4ee128
call edi
test bl, bl
jne 0x42c42a
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42c3e0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x42c4b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push 0x4ee128
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [0x4ee088], ebx
mov dword [esp + 0xc], ebx
jle 0x42c53c
push esi
push edi
mov eax, dword [0x4ee090]
mov edi, dword [eax + ebx*4]
mov eax, ebp
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x42c4e0
sub eax, esi
je 0x42c50c
lea ecx, [ecx]
movzx edx, byte [eax + ebp - 1]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4ec8a8]
sub eax, 1
jne 0x42c4f0
mov esi, dword [edi + 0x2c]
xor eax, eax
test esi, esi
jle 0x42c526
mov edx, dword [edi + 0x30]
cmp dword [edx], ecx
je 0x42c533
add eax, 1
add edx, 0x40
cmp eax, esi
jl 0x42c518
add ebx, 1
cmp ebx, dword [0x4ee088]
jl 0x42c4d1
jmp 0x42c53a
mov eax, dword [edx + 4]
mov dword [esp + 0x14], eax
pop edi
pop esi
push 0x4ee128
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret 4
Function at 0x42c5a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push 0x4ee128
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4ee088], ebx
jle 0x42c675
push esi
push edi
mov eax, dword [0x4ee090]
mov edi, dword [eax + ebx*4]
mov eax, ebp
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x42c5d4
sub eax, esi
je 0x42c5fd
movzx edx, byte [eax + ebp - 1]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4ec8a8]
sub eax, 1
jne 0x42c5e1
mov edx, dword [edi + 0x2c]
xor eax, eax
test edx, edx
jle 0x42c61e
mov esi, dword [edi + 0x30]
lea esp, [esp]
cmp dword [esi], ecx
je 0x42c62b
add eax, 1
add esi, 0x40
cmp eax, edx
jl 0x42c610
add ebx, 1
cmp ebx, dword [0x4ee088]
jl 0x42c5c5
jmp 0x42c673
mov eax, dword [0x4ee090]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x42c673
push 0x24
call fcn.00459d0c
mov ebx, eax
add esp, 4
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], edi
cmp dword [edi + 0x1c], 0x10
mov dword [esp + 0x14], ebx
jb 0x42c658
mov edi, dword [edi + 8]
jmp 0x42c65b
add edi, 8
push 0x497cf8
push edi
call fcn.0045bfb8
add esp, 8
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0
pop edi
pop esi
push 0x4ee128
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret 4

Function at 0x42c7e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, ecx
push 0x497cf8
push ebx
mov edi, eax
call fcn.0045bfb8
mov esi, eax
add esp, 8
test esi, esi
jne 0x42c805
pop edi
pop esi
pop ebp
pop ebx
ret
test edi, edi
jne 0x42c83f
push 0x497cf8
push ebx
call fcn.0045bfb8
mov edi, eax
add esp, 8
test edi, edi
jne 0x42c822
or edi, 0xffffffff
jmp 0x42c83f
push 2
push 0
push edi
call fcn.0045c052
push edi
call fcn.0045c26f
push edi
mov ebx, eax
call fcn.0045bc97
add esp, 0x14
mov edi, ebx
test ebp, ebp
jne 0x42c84e
push edi
call fcn.0045a843
add esp, 4
mov ebp, eax
mov eax, dword [esp + 0x18]
push 0
push eax
push esi
call fcn.0045c052
push esi
push edi
push 1
push ebp
call fcn.0045c579
push esi
call fcn.0045bc97
add esp, 0x20
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x42d730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x48
mov eax, dword [esp + 0x54]
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push esi
push edi
push eax
lea ecx, [esp + 0x3c]
push str.MNGNUM__02d
push ecx
call fcn.0045b0bf
add esp, 0xc
xor ebx, ebx
lea eax, [esp + 0x38]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea edx, [eax + 1]
jmp 0x42d770
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42d770
sub eax, edx
push eax
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x24]
call fcn.00404090
lea eax, [esp + 0x1c]
mov ecx, ebp
call fcn.0042a5d0
cmp eax, ebx
je 0x42d7a2
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
jmp 0x42d7a6
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x34], 0x10
jb 0x42d7ba
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00459ea4
add esp, 4
cmp dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
jle 0x42d8e0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
push edx
push eax
lea ecx, [esp + 0x40]
push str.MNG__02d__04d
push ecx
call fcn.0045b0bf
lea eax, [esp + 0x48]
add esp, 0x10
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea edx, [eax + 1]
jmp 0x42d800
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42d800
sub eax, edx
push eax
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x24]
call fcn.00404090
cmp dword [esp + 0x34], 0x10
mov esi, dword [esp + 0x20]
jae 0x42d829
lea esi, [esp + 0x20]
mov eax, esi
xor ecx, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x42d830
sub eax, edi
je 0x42d85c
lea ecx, [ecx]
movzx edx, byte [esi + eax - 1]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4ec8a8]
sub eax, 1
jne 0x42d840
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp esi, ebx
jle 0x42d885
mov edi, dword [ebp + 0x1c]
mov edx, edi
lea ebx, [ebx]
mov ebp, dword [edx]
cmp dword [ebp], ecx
je 0x42d8ea
add eax, 1
add edx, 4
cmp eax, esi
jl 0x42d870
mov ebp, dword [esp + 0x60]
mov esi, dword [ebp + 0x60]
cmp dword [esp + 0x34], 0x10
jb 0x42d89c
mov eax, dword [esp + 0x20]
push eax
call fcn.00459ea4
add esp, 4
cmp esi, ebx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
je 0x42d8cb
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
call fcn.0042fe80
cmp eax, ebx
je 0x42d8cb
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
jl 0x42d7c8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
mov esi, dword [edi + eax*4]
mov ebp, dword [esp + 0x60]
jmp 0x42d888
Function at 0x432080
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x492618
push eax
mov dword fs:[0], esp
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
mov dword [esi + 0x24], ebx
push edi
mov edi, 0xf
mov dword [esi + 0x28], edi
mov byte [esi + 0x14], bl
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x30], 1
mov dword [esp + 0x14], ebx
mov dword [esi], vtable.SB_MODEL.0
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x4c], bl
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], ebx
mov byte [esi + 0x68], bl
mov dword [esi + 0x98], edi
mov dword [esi + 0x94], ebx
mov byte [esi + 0x84], bl
push 0x40
lea eax, [esi + 0xa8]
push ebx
push eax
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], 0x10
mov dword [esi + 0xa4], eax
call fcn.0045ed30
push 0xc0
lea eax, [esi + 0xf4]
push ebx
push eax
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], 0x10
mov dword [esi + 0xf0], eax
call fcn.0045ed30
add esp, 0x18
mov byte [esp + 0x14], 5
mov dword [esi + 0xc], edi
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1ec], ebx
call fcn.00432310
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x433570
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x492563
push eax
mov dword fs:[0], esp
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], eax
mov byte [esi + 0x14], al
mov edx, 1
mov byte [esi + 8], al
mov byte [esi + 9], al
mov byte [esi + 0x35], al
mov byte [esi + 0x34], al
mov dword [esi + 0x30], edx
mov dword [esp + 0xc], eax
lea ecx, [esi + 0x4c]
mov dword [esi], vtable.SB_MUSIC.0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
mov byte [ecx + 4], al
mov byte [esp + 0xc], dl
push eax
push 0x49747a
mov dword [esi + 0xc], 3
mov dword [esi + 0x68], eax
mov byte [esi + 0x6c], al
mov dword [esi + 0x48], 0x64
call fcn.00404090
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4391b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x492268
push eax
mov dword fs:[0], esp
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], ebx
mov byte [esi + 0x14], bl
push edi
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x30], 1
push method.SB_MNG.virtual_12
push 0x4388f0
push 0x10
push 0x40
lea edi, [esi + 0x5c]
mov dword [esp + 0x24], ebx
push edi
mov dword [esi], vtable.SB_PATH.0
call fcn.0045b850
push 0x400
push ebx
push edi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], 0x10
mov dword [esi + 0x58], edi
call fcn.0045ed30
fld dword [0x499a48]
mov ecx, dword [esp + 0x18]
fstp dword [esi + 0x4c]
add esp, 0xc
pop edi
mov dword [esi + 0xc], 0xe
mov dword [esi + 0x48], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x43cac0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49288b
push eax
mov dword fs:[0], esp
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x28], 0xf
mov dword [edi + 0x24], ebx
mov byte [edi + 0x14], bl
mov byte [edi + 8], bl
mov byte [edi + 9], bl
mov byte [edi + 0x35], bl
mov byte [edi + 0x34], bl
mov dword [edi + 0x30], 1
mov dword [esp + 0x14], ebx
push 0x40
lea eax, [edi + 0x54]
mov dword [edi], vtable.SB_PLAYER.0
push ebx
mov esi, 0x10
push eax
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], esi
mov dword [edi + 0x50], eax
call fcn.0045ed30
add esp, 0xc
push 0x43a880
push 0x43a7d0
push 3
mov byte [esp + 0x20], 1
push 0x70
lea eax, [edi + 0x1bc]
mov dword [edi + 0x94], ebx
mov dword [edi + 0x98], ebx
push eax
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
call fcn.0045b850
push 0x439c60
push 0x439be0
push 8
push 0xac
lea ecx, [edi + 0x30c]
push ecx
mov byte [esp + 0x28], 2
call fcn.0045b850
push 0x40
lea eax, [edi + 0x88c]
mov dword [edi + 0x878], ebx
mov dword [edi + 0x87c], ebx
push ebx
push eax
mov dword [edi + 0x880], ebx
mov dword [edi + 0x884], esi
mov dword [edi + 0x888], eax
call fcn.0045ed30
add esp, 0xc
lea esi, [edi + 0x8cc]
call fcn.00430960
mov eax, 0x78
mov dword [edi + 0xc], 4
mov dword [edi + 0x94], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0x18c], ebx
mov dword [edi + 0x190], ebx
mov dword [edi + 0x194], ebx
mov dword [edi + 0x198], ebx
mov dword [edi + 0x19c], eax
mov dword [edi + 0x1a0], eax
mov dword [edi + 0x1a4], ebx
mov dword [edi + 0x1a8], ebx
mov byte [edi + 0x1b8], bl
mov dword [edi + 0xa4], ebx
or eax, 0xffffffff
mov dword [edi + 0x86c], eax
mov dword [edi + 0x870], eax
mov dword [edi + 0x878], ebx
mov dword [edi + 0x874], ebx
mov dword [edi + 0x1ac], ebx
mov dword [edi + 0x1b0], ebx
mov dword [edi + 0x1b4], ebx
mov byte [edi + 0x1b9], bl
mov byte [edi + 0x1ba], 1
lea eax, [edi + 0xa8]
lea ecx, [ebx + 8]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
add eax, 0xc
sub ecx, 1
jne 0x43cc53
lea eax, [edi + 0x168]
mov ecx, 9
mov edi, edi
mov dword [eax - 0x24], ebx
mov dword [eax], 0x64
add eax, 4
sub ecx, 1
jne 0x43cc70
mov dword [edi + 0x10c], ebx
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x110], ebx
mov dword [edi + 0x114], ebx
mov dword [edi + 0x118], ebx
mov dword [edi + 0x11c], ebx
mov dword [edi + 0x120], ebx
mov dword [edi + 0x124], ebx
mov dword [edi + 0x128], ebx
mov dword [edi + 0x12c], ebx
mov dword [edi + 0x130], ebx
mov dword [edi + 0x134], ebx
mov dword [edi + 0x138], ebx
mov dword [edi + 0x13c], ebx
mov dword [edi + 0x140], ebx
mov dword [edi + 0x108], 1
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x440690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49224e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], ebx
mov byte [esi + 0x14], bl
push edi
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x30], 1
push 0x43f790
push 0x43f770
mov ebp, 0x10
push ebp
mov dword [esp + 0x2c], ebx
push 0x1c
mov dword [esi], vtable.SB_SCRIPT.0
lea edi, [esi + 0x5c]
push edi
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
call fcn.0045b850
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], edi
push 0x40
lea eax, [esi + 0x2ec]
push ebx
push eax
mov dword [esi + 0x2e0], ebx
mov dword [esi + 0x2e4], ebp
mov dword [esi + 0x2e8], eax
call fcn.0045ed30
add esp, 0xc
mov byte [esp + 0x20], 2
mov dword [esi + 0xc], 9
mov dword [esi + 0x48], ebx
mov dword [esp + 0x10], ebp
lea ebx, [esi + 0x50]
call fcn.00441680
mov ebp, eax
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, edi
mov edx, 0x4c
mul edx
seto cl
mov dword [ebp + 4], edi
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00459cee
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov byte [esp + 0x20], 3
je 0x4407a2
push 0x43f3e0
push 0x43f3b0
push edi
lea ebx, [eax + 4]
push 0x4c
push ebx
mov dword [eax], edi
call fcn.0045b850
jmp 0x4407a4
xor ebx, ebx
sub dword [esp + 0x10], 1
mov byte [esp + 0x20], 2
mov dword [ebp + 8], ebx
jne 0x440740
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4