Function at 0x6ad42a10
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
test byte [0x6ad45018], 8
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov edi, dword [ecx + 0x10]
jne 0x6ad42b93
cmp edx, 0x400a
je 0x6ad42ec0
jbe 0x6ad42b32
cmp edx, 0x400e
je 0x6ad42d40
ja 0x6ad42be0
cmp edx, 0x400c
je 0x6ad42ca0
ja 0x6ad42e50
test byte [0x6ad45018], 8
jne 0x6ad43015
test ebx, ebx
je 0x6ad42f90
cmp dword [ebx], 0x64697663
jne 0x6ad42f90
test byte [0x6ad45018], 8
jne 0x6ad43170
cmp dword [esi + 0x10], 0x64697663
jne 0x6ad42b1d
test edi, edi
je 0x6ad42c84
test byte [0x6ad45018], 8
jne 0x6ad433e0
movzx eax, word [edi + 0xc]
cmp word [esi + 0xc], ax
jne 0x6ad42b1d
mov eax, dword [esi + 8]
mov edx, dword [edi + 8]
cmp eax, edx
je 0x6ad42ae6
add eax, edx
jne 0x6ad42b1d
test byte [0x6ad45018], 8
jne 0x6ad4352a
mov eax, dword [edi + 4]
cmp dword [esi + 4], eax
jne 0x6ad42b1d
movzx eax, word [edi + 0xe]
cmp ax, 0x18
je 0x6ad42c84
cmp ax, 0x20
je 0x6ad42c84
cmp ax, 0x10
je 0x6ad4341d
test byte [0x6ad45018], 8
jne 0x6ad435f4
mov ecx, 0xfffffffe
lea esp, [ebp - 0x10]
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
cmp edx, 4
je 0x6ad42f40
ja 0x6ad42c20
cmp edx, 2
je 0x6ad42c84
ja 0x6ad42de4
cmp edx, 1
jne 0x6ad42c09
test byte [0x6ad45018], 8
mov ecx, 1
je 0x6ad42b22
mov dword [esp + 0xc], str.Loaded_n
mov dword [esp + 8], str.ICCVID_DriverProc
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
mov dword [ebp - 0x28], ecx
call fcn.6ad41670
mov ecx, dword [ebp - 0x28]
jmp 0x6ad42b22
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._ld__p__d__ld__ld_n
mov dword [esp + 8], str.ICCVID_DriverProc
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
mov dword [ebp - 0x28], edx
call fcn.6ad41670
mov edx, dword [ebp - 0x28]
jmp 0x6ad42a3f
cmp edx, 0x5002
je 0x6ad42c70
cmp edx, 0x500a
mov ecx, 0xffffffff
je 0x6ad42b22
cmp edx, 0x403e
je 0x6ad42d64
test byte [0x6ad45018], 1
jne 0x6ad430c0
mov ecx, 0xffffffff
jmp 0x6ad42b22
cmp edx, 6
jbe 0x6ad42c84
cmp edx, 0x4006
jne 0x6ad42c09
test byte [0x6ad45018], 1
mov ecx, 0xfffffffe
je 0x6ad42b22
mov dword [esp + 0xc], str.compression_not_implemented_n
mov dword [esp + 8], str.ICCVID_DriverProc
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 0
mov dword [ebp - 0x28], ecx
call fcn.6ad41670
mov ecx, dword [ebp - 0x28]
jmp 0x6ad42b22
test esi, esi
je 0x6ad43520
cmp edi, 0x237
ja 0x6ad43358
xor ecx, ecx
lea esp, [ebp - 0x10]
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
test byte [0x6ad45018], 8
jne 0x6ad43120
test ebx, ebx
je 0x6ad42f90
cmp dword [ebx], 0x64697663
jne 0x6ad42f90
movzx edx, word [edi + 0xe]
movzx eax, byte [0x6ad45018]
and eax, 8
cmp edx, 0x10
mov dword [ebx + 4], edx
je 0x6ad43155
test al, al
jne 0x6ad431b0
mov eax, dword [ebx + 8]
test eax, eax
je 0x6ad42cef
call fcn.6ad415d0
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
test eax, eax
je 0x6ad42d32
mov edx, dword [section..bss]
mov dword [eax + 0x100], 0
test edx, edx
je 0x6ad431e0
mov dword [ebx + 8], eax
xor ecx, ecx
jmp 0x6ad42b22
mov eax, dword [ebx + 8]
xor ecx, ecx
test eax, eax
je 0x6ad42b22
mov dword [ebp - 0x28], ecx
call fcn.6ad415d0
mov dword [ebx + 8], 0
mov ecx, dword [ebp - 0x28]
jmp 0x6ad42b22
test byte [0x6ad45018], 8
jne 0x6ad43085
test ebx, ebx
je 0x6ad42f90
cmp dword [ebx], 0x64697663
jne 0x6ad42f90
mov eax, dword [ebx + 8]
test eax, eax
je 0x6ad42fa0
mov edi, dword [esi + 4]
mov ecx, dword [edi + 8]
mov dword [ebp - 0x28], edi
mov edi, dword [edi + 0x14]
mov dword [ebp - 0x2c], edi
mov edx, dword [esi + 8]
mov edi, ecx
mov dword [ebp - 0x30], edx
mov edx, dword [esi + 0xc]
add edi, dword [edx + 8]
mov edi, dword [ebp - 0x28]
sete dl
movzx edx, dl
mov dword [esp + 0x10], edx
mov ebx, dword [ebx + 4]
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov edx, dword [edi + 4]
mov dword [esp + 4], edx
mov edx, dword [esi + 0x10]
mov dword [esp], edx
mov edx, dword [ebp - 0x30]
call fcn.6ad41a40
xor ecx, ecx
jmp 0x6ad42b22
test byte [0x6ad45018], 8
jne 0x6ad430f5
test edi, edi
je 0x6ad42e08
mov eax, dword [edi + 4]
xor eax, 0x63646976
test eax, 0xdfdfdfdf
jne 0x6ad42c84
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
test eax, eax
je 0x6ad42e40
mov dword [eax], 0x64697663
mov dword [eax + 8], 0
mov ecx, eax
jmp 0x6ad42b22
test byte [0x6ad45018], 8
jne 0x6ad43050
test ebx, ebx
je 0x6ad42f90
cmp dword [ebx], 0x64697663
jne 0x6ad42f90
mov eax, dword [ebx + 8]
test eax, eax
jne 0x6ad42d90
test byte [0x6ad45018], 2
je 0x6ad42f90
mov dword [esp + 0xc], str.ICM_DECOMPRESS_sent_after_ICM_DECOMPRESS_END_n
mov dword [esp + 8], str.ICCVID_Decompress
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 1
call fcn.6ad41670
mov ecx, 0xfffffffa
jmp 0x6ad42b22
test byte [0x6ad45018], 8
jne 0x6ad42fe0
test ebx, ebx
je 0x6ad42f90
cmp dword [ebx], 0x64697663
jne 0x6ad42f90
cmp word [esi + 0xe], 8
mov ecx, dword [esi]
ja 0x6ad42ef0
mov eax, dword [esi + 0x20]
lea ecx, [ecx + eax*4]
test edi, edi
je 0x6ad42b22
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.ucrtbase.dll_memcpy
mov ecx, 0x18
mov dword [edi + 0x10], 0
mov word [edi + 0xe], cx
mov eax, dword [esi + 4]
xor ecx, ecx
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x1f]
sar eax, 3
and eax, 0xfffffffc
imul eax, dword [esi + 8]
mov dword [edi + 0x14], eax
jmp 0x6ad42c86
test ebx, ebx
je 0x6ad42c84
cmp dword [ebx], 0x64697663
jne 0x6ad42c84
mov eax, dword [ebx + 8]
test eax, eax
je 0x6ad42f60
call fcn.6ad415d0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov ecx, 1
sub esp, 0xc
jmp 0x6ad42b22
mov ecx, 0xfffffffa
jmp 0x6ad42b22
test byte [0x6ad45018], 2
je 0x6ad42f90
mov dword [esp + 0xc], str.ICM_DECOMPRESSEX_sent_after_ICM_DECOMPRESS_END_n
mov dword [esp + 8], str.ICCVID_DecompressEx
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 1
call fcn.6ad41670
mov ecx, 0xfffffffa
jmp 0x6ad42b22
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.ICM_DECOMPRESS_GETFORMAT__p__p__p_n
mov dword [esp + 8], str.ICCVID_DecompressGetFormat
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42ecd
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.ICM_DECOMPRESS_QUERY__p__p__p_n
mov dword [esp + 8], str.ICCVID_DecompressQuery
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42a82
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.ICM_DECOMPRESS__p__p__d_n
mov dword [esp + 8], str.ICCVID_Decompress
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42e5d
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.ICM_DECOMPRESSEX__p__p__d_n
mov dword [esp + 8], str.ICCVID_DecompressEx
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42d71
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Unknown_message:__04x__ld__ld_n
mov dword [esp + 8], str.ICCVID_DriverProc
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 0
call fcn.6ad41670
jmp 0x6ad42c16
mov dword [esp + 0xc], str.Opened_n
mov dword [esp + 8], str.ICCVID_DriverProc
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42df1
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.ICM_DECOMPRESS_BEGIN__p__p__p_n
mov dword [esp + 8], str.ICCVID_DecompressBegin
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42cad
cmp dword [edi + 0x10], 3
je 0x6ad43553
mov dword [ebx + 4], 0xf
jmp 0x6ad42cdb
mov dword [esp + 0xc], str.in:
mov dword [esp + 8], str.ICCVID_DecompressQuery
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
test byte [0x6ad45018], 8
je 0x6ad42aa3
mov eax, esi
call fcn.6ad419e0
jmp 0x6ad42aa3
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], str.bit_per_pixel___d_n
mov dword [esp + 8], str.ICCVID_DecompressBegin
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.6ad41670
jmp 0x6ad42ce3
pxor xmm7, xmm7
mov dword [section..bss], 0x6ad49220
movdqa xmm2, xmmword [0x6ad47610]
mov edx, 0x6ad49021
mov byte [0x6ad49020], 0
movdqa xmm1, xmmword [0x6ad47660]
lea esi, [esi]
movdqa xmm0, xmm2
movdqa xmm3, xmm1
movdqa xmm5, xmmword [0x6ad47630]
add edx, 0x10
pcmpgtd xmm0, xmm1
paddd xmm5, xmm2
movdqa xmm4, xmmword [str._b_b_b_b_f_f_f_f]
pand xmm3, xmm0
pandn xmm0, xmm2
paddd xmm4, xmm2
movdqa xmm6, xmmword [0x6ad47650]
paddd xmm6, xmm2
por xmm3, xmm0
movdqa xmm0, xmm7
pcmpgtd xmm0, xmm2
paddd xmm2, xmmword [0x6ad47620]
pandn xmm0, xmm3
movdqa xmm3, xmm5
movaps xmmword [ebp - 0x28], xmm0
pcmpgtd xmm3, xmm1
movdqa xmm0, xmm1
pand xmm0, xmm3
pandn xmm3, xmm5
por xmm3, xmm0
movdqa xmm0, xmm7
pcmpgtd xmm0, xmm5
movdqa xmm5, xmm0
movdqa xmm0, xmmword [ebp - 0x28]
pandn xmm5, xmm3
movdqa xmm3, xmm0
punpcklwd xmm0, xmm5
punpckhwd xmm3, xmm5
movdqa xmm5, xmm0
punpcklwd xmm0, xmm3
punpckhwd xmm5, xmm3
movdqa xmm3, xmm4
pcmpgtd xmm3, xmm1
punpcklwd xmm0, xmm5
movdqa xmm5, xmm1
pand xmm5, xmm3
pandn xmm3, xmm4
pand xmm0, xmmword [0x6ad47670]
por xmm5, xmm3
movdqa xmm3, xmm7
pcmpgtd xmm3, xmm4
movdqa xmm4, xmm6
pandn xmm3, xmm5
pcmpgtd xmm4, xmm1
movdqa xmm5, xmm1
pand xmm5, xmm4
pandn xmm4, xmm6
por xmm4, xmm5
movdqa xmm5, xmm7
pcmpgtd xmm5, xmm6
pandn xmm5, xmm4
movdqa xmm4, xmm5
movdqa xmm5, xmm3
punpcklwd xmm3, xmm4
punpckhwd xmm5, xmm4
movdqa xmm4, xmm3
punpcklwd xmm3, xmm5
punpckhwd xmm4, xmm5
punpcklwd xmm3, xmm4
pand xmm3, xmmword [0x6ad47670]
packuswb xmm0, xmm3
movups xmmword [edx - 0x10], xmm0
cmp edx, 0x6ad49411
jne 0x6ad43210
mov edx, 0x1f1
mov byte [edx + 0x6ad49220], 0xff
add edx, 1
cmp edx, 0x200
jne 0x6ad43341
jmp 0x6ad42d32
test ebx, ebx
mov dword [esi], 0x238
mov dword [esi + 4], 0x63646976
mov eax, 0x64697663
je 0x6ad43370
mov eax, dword [ebx]
mov dword [esi + 8], eax
lea eax, [esi + 0x18]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x104
mov dword [esi + 0x14], 0x104
add esi, 0x38
mov dword [esp + 8], eax
mov eax, dword [0x6ad49424]
mov dword [esp + 0xc], 0x10
mov dword [esp + 4], 0x64
mov dword [esp], eax
call sub.user32.dll_LoadStringW
mov eax, dword [0x6ad49424]
sub esp, 0x10
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 8], esi
mov dword [esp + 4], 0x65
mov dword [esp], eax
call sub.user32.dll_LoadStringW
mov ecx, 0x238
sub esp, 0x10
jmp 0x6ad42b22
mov dword [esp + 0xc], str.out:
mov dword [esp + 8], str.ICCVID_DecompressQuery
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
test byte [0x6ad45018], 8
je 0x6ad42ac1
mov eax, edi
call fcn.6ad419e0
jmp 0x6ad42ac1
cmp dword [edi + 0x10], 3
jne 0x6ad42c84
movzx ecx, byte [edi + 0x2a]
movzx eax, byte [edi + 0x29]
lea esi, [edi + 0x28]
movzx edx, byte [edi + 0x2e]
movzx ebx, byte [edi + 0x32]
shl eax, 8
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edi + 0x28]
shl edx, 0x10
shl ebx, 0x10
or ecx, eax
movzx eax, byte [edi + 0x2d]
shl eax, 8
or edx, eax
movzx eax, byte [edi + 0x2c]
or edx, eax
movzx eax, byte [edi + 0x31]
shl eax, 8
or ebx, eax
movzx eax, byte [edi + 0x30]
or ebx, eax
test byte [0x6ad45018], 8
je 0x6ad434b1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], str._nbmiColors_0___0x_08x_nbmiColors_1___0x_08x_nbmiColors_2___0x_08x_n
mov dword [esp + 8], str.ICCVID_CheckMask
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
call fcn.6ad41670
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
cmp ecx, 0x7c00
sete cl
cmp edx, 0x3e0
sete al
test cl, al
je 0x6ad434d0
cmp ebx, 0x1f
je 0x6ad42c84
mov ecx, 0x7e0
mov edx, 0xf800
mov eax, esi
call fcn.6ad41700
test eax, eax
jne 0x6ad42c84
test byte [0x6ad45018], 8
je 0x6ad42b1d
mov dword [esp + 0xc], str.unsupported_output_bit_field_s__for_16_bit_colors_n
mov dword [esp + 8], str.ICCVID_DecompressQuery
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42b1d
mov ecx, 0x238
jmp 0x6ad42b22
mov dword [esp + 0xc], str.Detected_inverted_height_for_video_output_n
mov dword [esp + 8], str.ICCVID_DecompressQuery
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad42ae6
movzx edx, byte [edi + 0x2a]
movzx ecx, byte [edi + 0x29]
lea esi, [edi + 0x28]
mov dword [ebp - 0x2c], esi
movzx esi, byte [edi + 0x2e]
shl ecx, 8
shl edx, 0x10
or edx, ecx
movzx ecx, byte [edi + 0x28]
shl esi, 0x10
or edx, ecx
movzx ecx, byte [edi + 0x32]
mov dword [ebp - 0x28], edx
mov edx, esi
movzx esi, byte [edi + 0x2d]
shl ecx, 0x10
shl esi, 8
or esi, edx
movzx edx, byte [edi + 0x2c]
or esi, edx
movzx edx, byte [edi + 0x31]
movzx edi, byte [edi + 0x30]
shl edx, 8
or edx, ecx
or edi, edx
test al, al
jne 0x6ad4363c
cmp dword [ebp - 0x28], 0x7c00
sete dl
cmp esi, 0x3e0
sete al
test dl, al
je 0x6ad435c4
cmp edi, 0x1f
je 0x6ad43626
mov eax, dword [ebp - 0x2c]
mov ecx, 0x7e0
mov edx, 0xf800
call fcn.6ad41700
test eax, eax
je 0x6ad43674
movzx eax, byte [0x6ad45018]
mov dword [ebx + 4], 0x10
and eax, 8
jmp 0x6ad42cdb
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unsupported_output_bitcount___d_n
mov dword [esp + 8], str.ICCVID_DecompressQuery
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
mov ecx, 0xfffffffe
jmp 0x6ad42b22
movzx eax, byte [0x6ad45018]
mov dword [ebx + 4], 0xf
and eax, 8
jmp 0x6ad42cdb
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], str._nbmiColors_0___0x_08x_nbmiColors_1___0x_08x_nbmiColors_2___0x_08x_n
mov dword [esp + 8], str.ICCVID_CheckMask
mov dword [esp + 4], 0x6ad45018
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.6ad41670
jmp 0x6ad435a8
test byte [0x6ad45018], 8
je 0x6ad42c16
mov dword [esp + 0xc], str.unsupported_output_bit_field_s__for_16_bit_colors_n
mov dword [esp + 8], str.ICCVID_DecompressBegin
mov dword [esp + 4], 0x6ad45018
mov dword [esp], 3
call fcn.6ad41670
or ecx, 0xffffffff
jmp 0x6ad42b22