joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420f20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x489569
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi], 0x493ce4
mov dword [esp + 0x24], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 3
mov dword [esi + 0x2c], edi
call fcn.004153e0
mov ebx, eax
mov dword [esp + 0x14], ebx
call fcn.004855e0
neg ebx
sbb ebx, ebx
test ebx, fcn.004054b0
mov dword [esp + 0x18], eax
je 0x420fb4
push str.mutex
lea ecx, [esp + 0x18]
push ecx
call fcn.0040ccd0
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4

Function at 0x420fe0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
push 0xffffffffffffffff
push 0
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4ae8f0
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
push 0
je 0x421031
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
mov edx, dword [esi + 4]
push edx
push fcn.00437070
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret
Function at 0x4220d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x489798
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.00405400
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.0041f4b0
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00476d69
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x4221c7
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.00476608
mov eax, dword [edi + 4]
test eax, eax
jbe 0x4221a5
cmp eax, 0xffffffff
jae 0x4221a5
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.00476629
test esi, esi
je 0x4221c7
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x422208
test edi, edi
je 0x422201
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x4221ed
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x4221ed
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4221f6
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422201
mov byte [esp + 0x6d], al
jmp 0x422203
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x42223e
test esi, esi
je 0x42223c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x42222e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x42222e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422237
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x42223e
xor esi, esi
test edi, edi
jne 0x422248
test esi, esi
je 0x42224c
jmp 0x422250
test esi, esi
je 0x422250
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x42226d
cmp dword [esp + 0x10], 0
jne 0x42226d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x422271
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045b7a6
add esp, 0x4c
ret 0x28
Function at 0x4222b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x489798
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.00405400
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.0041f4b0
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00476bd3
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x4223a7
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.00476608
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422385
cmp eax, 0xffffffff
jae 0x422385
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.00476629
test esi, esi
je 0x4223a7
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x4223e8
test edi, edi
je 0x4223e1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x4223cd
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x4223cd
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4223d6
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x4223e1
mov byte [esp + 0x6d], al
jmp 0x4223e3
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x42241e
test esi, esi
je 0x42241c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x42240e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x42240e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422417
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x42241e
xor esi, esi
test edi, edi
jne 0x422428
test esi, esi
je 0x42242c
jmp 0x422430
test esi, esi
je 0x422430
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x42244d
cmp dword [esp + 0x10], 0
jne 0x42244d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x422451
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045b7a6
add esp, 0x4c
ret 0x28
Function at 0x422490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48bd78
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.00405400
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.0041f4b0
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0045d32a
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x422578
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00476608
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422556
cmp eax, 0xffffffff
jae 0x422556
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.00476629
test esi, esi
je 0x422578
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x4225b9
test edi, edi
je 0x4225b2
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x42259e
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x42259e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4225a7
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x4225b2
mov byte [esp + 0x6d], al
jmp 0x4225b4
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x4225ef
test esi, esi
je 0x4225ed
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x4225df
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x4225df
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4225e8
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x4225ef
xor esi, esi
test edi, edi
jne 0x4225f9
test esi, esi
je 0x4225fd
jmp 0x422600
test esi, esi
je 0x422600
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x42261d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x422620
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0045b7a6
add esp, 0x48
ret 0x28
Function at 0x422660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48bd78
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.00405400
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.0041f4b0
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0045d353
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x422748
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00476608
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422726
cmp eax, 0xffffffff
jae 0x422726
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.00476629
test esi, esi
je 0x422748
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x422789
test edi, edi
je 0x422782
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x42276e
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x42276e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422777
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422782
mov byte [esp + 0x6d], al
jmp 0x422784
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x4227bf
test esi, esi
je 0x4227bd
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x4227af
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x4227af
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4227b8
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x4227bf
xor esi, esi
test edi, edi
jne 0x4227c9
test esi, esi
je 0x4227cd
jmp 0x4227d0
test esi, esi
je 0x4227d0
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x4227ed
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x4227f0
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0045b7a6
add esp, 0x48
ret 0x28
Function at 0x422a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4897c8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.00405400
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.0041fa00
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00476e2c
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x422b2e
push 0
lea ecx, [esp + 0x1c]
call fcn.00476608
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422b0c
cmp eax, 0xffffffff
jae 0x422b0c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.00476629
test esi, esi
je 0x422b2e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x422b7b
test edi, edi
je 0x422b71
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x422b5a
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x422b5a
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422b63
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422b71
mov byte [esp + 0x8d], al
jmp 0x422b73
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x422bb7
test esi, esi
je 0x422bb5
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x422ba7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x422ba7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422bb0
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x422bb7
xor esi, esi
test edi, edi
jne 0x422be0
test esi, esi
je 0x422be4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x422bed
cmp dword [esp + 0x14], 0
jne 0x422bed
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x422bf0
test esi, esi
je 0x422bbf
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x422bc3
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0045b7a6
add esp, 0x6c
ret 0x28
Function at 0x422c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4897c8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.00405400
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.0041fa00
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00476e93
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x422d2e
push 0
lea ecx, [esp + 0x1c]
call fcn.00476608
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422d0c
cmp eax, 0xffffffff
jae 0x422d0c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.00476629
test esi, esi
je 0x422d2e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x422d7b
test edi, edi
je 0x422d71
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x422d5a
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x422d5a
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422d63
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422d71
mov byte [esp + 0x8d], al
jmp 0x422d73
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x422db7
test esi, esi
je 0x422db5
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x422da7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x422da7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422db0
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x422db7
xor esi, esi
test edi, edi
jne 0x422de0
test esi, esi
je 0x422de4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x422ded
cmp dword [esp + 0x14], 0
jne 0x422ded
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x422df0
test esi, esi
je 0x422dbf
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x422dc3
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0045b7a6
add esp, 0x6c
ret 0x28
Function at 0x422e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x489768
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov esi, ecx
mov ecx, dword [esp + 0x80]
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
call fcn.00405400
push eax
push 0x800
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x74], 0
call fcn.0041f4b0
mov ebp, eax
mov eax, dword [esp + 0x3c]
add esp, 0x18
test eax, eax
mov dword [esp + 0x5c], 0xffffffff
je 0x422f17
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00476608
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422ef1
cmp eax, 0xffffffff
jae 0x422ef1
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.00476629
test esi, esi
je 0x422f13
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00476bd3
mov ebp, dword [esp + 0x7c]
add esp, 0x10
cmp byte [esp + 0x70], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
jne 0x422f7d
test ebp, ebp
je 0x422f76
mov eax, dword [ebp + 0x20]
cmp dword [eax], 0
je 0x422f61
mov ecx, dword [ebp + 0x30]
cmp dword [ecx], 0
jle 0x422f61
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422f6b
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
mov ecx, ebp
call edx
cmp eax, 0xffffffff
je 0x422f76
mov byte [esp + 0x71], al
jmp 0x422f78
xor ebp, ebp
mov byte [esp + 0x70], 1
cmp byte [esp + 0x7c], 0
mov esi, dword [esp + 0x78]
jne 0x422fb3
test esi, esi
je 0x422fb1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x422fa3
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x422fa3
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422fac
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x422fb3
xor esi, esi
test ebp, ebp
jne 0x422fbd
test esi, esi
je 0x422fc1
jmp 0x422fc4
test esi, esi
je 0x422fc4
or dword [edi], 1
lea eax, [esp + 0x30]
cmp dword [esp + 0x2c], eax
je 0x422fe1
cmp dword [esp + 0x18], 0
jne 0x422fe1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x422fe4
or dword [edi], 2
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x70]
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0045b7a6
add esp, 0x50
ret 0x28