joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f5cb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45f603
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045d69a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045d672
jmp 0x45f60f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x460cbe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x460d00
call fcn.004667b0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x460d00
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x460cf7
xor eax, eax
jmp 0x460d08
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00460d0e
pop edi
pop esi
pop ebx
ret 4

Function at 0x466ce0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x466d0e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x466d2c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00466c46
jmp 0x466d2c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x466d2c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00466c46
test edi, edi
mov eax, edi
jne 0x466d16
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x404072
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00401f20
movzx eax, al
test eax, eax
je 0x404030
xor eax, eax
jmp 0x4040c0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x404046
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.00403ee0
jmp 0x4040c0
push 0x57434c
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00406440
push eax
mov edx, dword [ebp - 4]
add edx, 8
push edx
call fcn.0050d005
add esp, 0xc
test eax, eax
je 0x40406e
xor eax, eax
jmp 0x4040c0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x40407b
xor eax, eax
jmp 0x4040c0
push 2
push 0xffffffffffffffe0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call fcn.0050d2c6
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
push 1
push 0x20
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
call fcn.0050db98
add esp, 0x10
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.00403ee0
test eax, eax
jne 0x4040bb
xor eax, eax
jmp 0x4040c0
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40a540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
call fcn.004076c0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00407620
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call fcn.004dd71e
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a580
xor eax, eax
jmp 0x40a5fd
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00407740
add esp, 0xc
test eax, eax
je 0x40a5e8
mov dword [ebp - 0x10], 0
push 0x57419c
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.0050d005
add esp, 0xc
test eax, eax
jne 0x40a5e8
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0050d1ba
add esp, 0x10
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
push eax
call fcn.0050d5e7
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004dd713
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x418400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push eax
call fcn.004076c0
add esp, 4
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00407700
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.00536a90
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004dd71e
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x418453
xor eax, eax
jmp 0x4184f4
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push 0x40
push 0x8000
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.005110eb
add esp, 0x14
test eax, eax
jne 0x4184df
push 0x57434c
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0051110b
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4184d3
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050db98
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00407790
add esp, 0xc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.0050d5e7
add esp, 4
jmp 0x4184df
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051133b
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004dd713
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x558f6b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
xor ebx, ebx
push ebx
mov dword [esi + 8], ecx
push ebx
lea ecx, [esi + 0xc]
mov dword [esi], 0x577a64
mov dword [esi + 4], eax
call fcn.004108d0
push ebx
push ebx
lea ecx, [esi + 0x14]
call fcn.004108d0
push ebx
push ebx
lea ecx, [esi + 0x1c]
call fcn.004108d0
push ebx
push ebx
lea ecx, [esi + 0x24]
call fcn.004108d0
push 0x574340
lea ecx, [esi + 0x2c]
call fcn.004039f0
lea edx, [esi + 0x30]
push edx
mov dword [esp + 0x1c], ebx
call fcn.0041f520
lea edi, [esi + 0x88]
mov ecx, edi
call fcn.004145f0
mov dword [edi], 0x577bd0
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x4209e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x558e99
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x20], edi
mov dword [edi], 0x577e30
mov dword [esp + 0x2c], 3
call fcn.00420eb0
call fcn.00420b90
mov eax, dword [edi + 0x24]
neg eax
sbb eax, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
call fcn.00402010
xor ebx, ebx
mov byte [esp + 0x2c], 4
cmp dword [esp + 0x14], ebx
je 0x420a7c
lea esi, [edi + 0x18]
lea esp, [esp]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.0050b7a2
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x420a76
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp dword [esp + 0x14], ebx
jne 0x420a50
lea ebp, [edi + 0x18]
mov ecx, ebp
call fcn.0050b712
mov ecx, dword [edi + 0x34]
cmp ecx, ebx
je 0x420a98
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 0x34], ebx
mov ecx, dword [edi + 0x38]
cmp ecx, ebx
je 0x420aaa
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 0x38], ebx
mov ecx, dword [edi + 0x3c]
cmp ecx, ebx
je 0x420abc
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 0x3c], ebx
mov esi, dword [edi + 0x98]
cmp esi, ebx
je 0x420adb
push esi
call fcn.0045f3d0
push esi
call fcn.004dd713
add esp, 4
mov dword [edi + 0x98], ebx
call fcn.0045efb0
call fcn.004600e0
mov esi, eax
cmp dword [esi + 0xa8], ebx
je 0x420afa
call fcn.00460270
mov dword [esi + 0xa8], ebx
push 0x577df4
call dword [0x55e42c]
mov ecx, dword [edi + 0x44]
cmp ecx, ebx
je 0x420b1d
cmp eax, ebx
je 0x420b1d
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x420b1d
push ecx
call eax
lea ecx, [esp + 0x18]
call fcn.00408b90
mov eax, dword [edi + 0x88]
lea esi, [edi + 0x84]
mov dword [esi], 0x577e78
cmp eax, ebx
je 0x420b45
push eax
call fcn.004dd713
add esp, 4
mov ecx, esi
call fcn.00416c50
lea ecx, [edi + 0x64]
push ecx
call dword [0x55e300]
add edi, 0x48
push edi
mov byte [esp + 0x30], bl
call fcn.00422000
mov ecx, ebp
mov dword [esp + 0x2c], 0xffffffff
call fcn.0050b770
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x424b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5563f8
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
sub esp, 8
mov ecx, esp
mov dword [esp + 0x10], esp
push 0
mov dword [esp + 0x20], 0
call fcn.00410c30
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov eax, dword [esp + 0x38]
mov edx, dword [ecx + 0xe4]
mov dword [esp + 0x20], esp
push eax
push edx
xor ecx, ecx
call fcn.0042a680
cmp dword [esp + 0x30], 0
mov edi, dword [0x55e090]
je 0x424bfc
mov eax, dword [esp + 0x24]
test eax, eax
je 0x424bf1
push eax
call dword [0x55e7a8]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x424bfc
push eax
call edi
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x424c07
push eax
call edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 0x18
Function at 0x425b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
mov esi, dword [0x55e1ac]
push edi
lea eax, [esp + 0x40]
push eax
push 0x18
push ecx
call esi
test eax, eax
je 0x425dd2
mov eax, dword [esp + 0x7c]
lea edx, [esp + 0x58]
push edx
push 0x18
push eax
call esi
test eax, eax
je 0x425dd2
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x28]
push ecx
push 0x18
push edx
call esi
test eax, eax
je 0x425dd2
mov bx, word [esp + 0x52]
cmp bx, word [esp + 0x6a]
jne 0x425dd2
mov di, word [esp + 0x50]
cmp di, word [esp + 0x68]
jne 0x425dd2
mov ecx, dword [esp + 0x44]
cmp ecx, dword [esp + 0x5c]
jne 0x425dd2
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x60]
jne 0x425dd2
cmp bx, word [esp + 0x3a]
jne 0x425dd2
cmp di, word [esp + 0x38]
jne 0x425dd2
mov eax, dword [esp + 0x2c]
cmp ecx, eax
jne 0x425dd2
mov esi, dword [esp + 0x30]
cmp edx, esi
jne 0x425dd2
cmp bx, 0x20
jne 0x425dd2
cmp di, 1
jne 0x425dd2
mov edi, dword [esp + 0x54]
test edi, edi
je 0x425dd2
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x425dd2
mov ebx, dword [esp + 0x3c]
test ebx, ebx
je 0x425dd2
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], 0
test esi, esi
jle 0x425dc3
inc ebx
mov dword [esp + 0x18], ebx
xor ebp, ebp
test eax, eax
jle 0x425da4
mov ecx, dword [esp + 0x7c]
mov edi, dword [esp + 0x18]
mov ebx, edx
sub ecx, edx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x20], ecx
jmp 0x425cdb
mov ebx, dword [esp + 0x84]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x78], 0
je 0x425cf0
mov esi, dword [esp + 0x7c]
mov ecx, eax
sub ecx, ebp
lea ecx, [esi + ecx*4 - 4]
jmp 0x425cf2
add ecx, ebx
cmp dword [esp + 0x80], 0
je 0x425d02
sub eax, ebp
lea ebx, [edx + eax*4 - 4]
movzx edx, byte [ecx + 3]
movzx esi, byte [ebx + 2]
mov eax, 0xff
sub eax, edx
imul esi, eax
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, byte [ecx + 2]
add dword [esp + 0x84], 4
mov byte [edi + 1], al
movzx edx, byte [ecx + 3]
movzx esi, byte [ebx + 1]
mov eax, 0xff
sub eax, edx
imul esi, eax
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, byte [ecx + 1]
mov esi, 0xff
mov byte [edi], al
movzx edx, byte [ecx + 3]
movzx eax, byte [ebx]
sub esi, edx
imul esi, eax
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, byte [ecx]
mov edx, dword [esp + 0x14]
mov byte [edi - 1], al
mov eax, dword [esp + 0x2c]
inc ebp
add edi, 4
cmp ebp, eax
jl 0x425cd0
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
add dword [esp + 0x7c], ecx
add dword [esp + 0x18], ecx
inc edi
add edx, ecx
cmp edi, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
jl 0x425ca5
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret 0x10
Function at 0x428fc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5563c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0x1c]
call fcn.00410c30
mov edx, dword [eax]
mov ecx, dword [esi]
mov eax, dword [eax + 4]
cmp ecx, edx
jne 0x429014
cmp dword [esi + 4], eax
jne 0x429014
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
cmp edi, ecx
jne 0x429030
push ebx
call dword [0x55e810]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
mov eax, dword [esi + 4]
push ecx
push edi
push eax
call dword [0x55e39c]
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.004108d0
lea ecx, [esp + 8]
call fcn.004e6f12
push 1
push 1
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0x21
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.004e732c
mov eax, dword [esp + 0xc]
push ebx
push eax
call fcn.004e7f91
mov ecx, dword [eax + 0x78]
mov ecx, dword [ecx]
call fcn.0042c250
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.004e7f91
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.00425440
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.004e745b
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x429750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5558b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x10]
call fcn.00410c30
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp dword [esp + 0x70], ecx
jne 0x4297a1
cmp dword [esp + 0x74], eax
jne 0x4297a1
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov edx, dword [esp + 0x54]
push edx
call fcn.004f5f47
push eax
push 0
lea eax, [esp + 0x34]
push eax
call fcn.004403c0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
add eax, ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
add eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x58]
add ecx, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
add edx, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edx
call fcn.0042a580
mov ecx, dword [esp + 0x50]
push esi
call fcn.00411740
push eax
lea esi, [esp + 0x14]
lea edi, [esp + 0x24]
call fcn.00426220
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.004404e0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret
Function at 0x4299b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x557af0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x68]
lea ecx, [esp + 0x24]
call fcn.004145f0
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
add edx, ecx
push edx
mov edx, dword [esp + 0x74]
test eax, eax
jge 0x429a06
push edx
push ecx
add edx, eax
push edx
lea eax, [esp + 0x34]
push eax
jmp 0x429a10
add eax, edx
push eax
push ecx
push edx
lea ecx, [esp + 0x34]
push ecx
call dword [0x55e73c]
lea ecx, [esp + 0x24]
call fcn.00410a70
push eax
lea ecx, [esp + 0x28]
call fcn.00416af0
push eax
lea ecx, [esp + 0x1c]
call fcn.004108d0
lea ecx, [esp + 0x1c]
call fcn.0040f030
mov dword [esp + 0x60], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, ebp
call fcn.00411740
push eax
lea esi, [esp + 0x74]
call fcn.00425de0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
call fcn.004f5f5b
lea ecx, [esp + 0x1c]
push ecx
push ebp
lea edx, [esp + 0x4c]
push edx
call fcn.004403c0
mov byte [esp + 0x60], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x44]
call fcn.00410d70
push 0xff00ff
lea ecx, [esp + 0x38]
call fcn.004145f0
push eax
lea ecx, [esp + 0x4c]
call fcn.004fc894
mov ecx, dword [esp + 0x78]
test ecx, ecx
jle 0x429abc
xor eax, eax
jmp 0x429ac0
mov eax, ecx
neg eax
mov edx, dword [esp + 0x7c]
push 3
push 0
push 0
push edx
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x80]
push ecx
push 0
push eax
push edx
call dword [0x55e81c]
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
jle 0x429b1e
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx]
cmp eax, 0xff00ff
jne 0x429b06
mov dword [ecx], 0
jmp 0x429b0d
or eax, 0xff000000
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x18]
inc edx
add ecx, 4
cmp edx, eax
jl 0x429af5
mov edi, dword [esp + 0x48]
test ebp, ebp
jne 0x429b2a
xor esi, esi
jmp 0x429b2d
mov esi, dword [ebp + 4]
call fcn.0042a580
push edi
push esi
lea esi, [esp + 0x3c]
lea edi, [esp + 0x2c]
call fcn.00426220
lea ecx, [esp + 0x44]
mov byte [esp + 0x60], 0
call fcn.004404e0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], 0xffffffff
call fcn.0040ede0
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x54
ret
Function at 0x42b8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x559a48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 0x5787b4
lea ebx, [edi + 0x24]
call edx
mov ebp, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x30], 0
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp]
push 1
push eax
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
cmp dword [esi + 0x28], 0
mov dword [esp + 0x14], eax
jne 0x42b9bf
mov eax, dword [ebx + 0xc]
neg eax
sbb eax, eax
mov dword [esp + 0x1c], eax
je 0x42ba30
lea ebx, [ebx]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.0042bb80
mov edx, dword [ebp]
mov edx, dword [edx + 8]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call edx
mov esi, eax
mov dword [esp + 0x24], esi
mov byte [esp + 0x30], 1
test esi, esi
je 0x42b999
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 3
push 0x5787c4
mov ecx, esi
call edx
mov eax, dword [esp + 0x18]
push eax
push edi
mov ecx, esi
call fcn.0042b550
mov byte [esp + 0x30], 0
test esi, esi
je 0x42b9b6
mov ecx, esi
call fcn.004fa0f9
cmp dword [esp + 0x1c], 0
jne 0x42b950
jmp 0x42ba30
call fcn.0042b430
cmp dword [esp + 0x14], 0
je 0x42ba30
mov bl, 2
lea ecx, [ecx]
mov edx, dword [ebp]
mov edx, dword [edx + 8]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call edx
mov esi, eax
mov dword [esp + 0x24], esi
mov byte [esp + 0x30], bl
mov dword [esp + 0x1c], 0
test esi, esi
je 0x42ba0c
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
push 0
lea ecx, [esp + 0x20]
push ecx
push 3
push 0x5787c4
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
push eax
push edi
mov ecx, esi
call fcn.0042b550
mov byte [esp + 0x30], 0
test esi, esi
je 0x42ba29
mov ecx, esi
call fcn.004fa0f9
cmp dword [esp + 0x14], 0
jne 0x42b9d0
mov dword [esp + 0x30], 0xffffffff
mov edx, dword [ebp]
mov eax, dword [edx]
push 1
mov ecx, ebp
call eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x430080
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5579f9
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.004df254
lea ebx, [esi + 0x54]
mov dword [esp + 0x1c], 0
mov ecx, ebx
mov dword [esi], 0x579554
call fcn.00402010
lea ebp, [esi + 0x58]
mov ecx, ebp
call fcn.00402010
lea ecx, [esi + 0x5c]
call fcn.00402010
lea edi, [esi + 0x64]
mov ecx, edi
mov byte [esp + 0x1c], 3
call fcn.004145f0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, ebp
mov dword [esi + 0x60], eax
call fcn.004039d0
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov dword [edi + 4], ecx
mov ecx, ebx
mov dword [esi + 0x74], edx
mov dword [edi], eax
call fcn.004025a0
mov edx, dword [esp + 0x3c]
xor eax, eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x6c], edx
mov dword [esi + 0x70], 1
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x439180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x557950
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x4391ae
xor eax, eax
jmp 0x4391b1
mov eax, dword [esi + 4]
push edi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00440210
mov dword [esp + 0x50], 0
test esi, esi
jne 0x4391cd
xor eax, eax
jmp 0x4391d0
mov eax, dword [esi + 4]
push edi
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004402d0
push 0x4139f0
push 3
push 8
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x60], 1
call fcn.00404790
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x3c], eax
push 3
lea eax, [esp + 0x34]
mov dword [esp + 0x44], ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x70]
push eax
push ecx
mov dword [esp + 0x50], edx
call dword [0x55e160]
mov byte [esp + 0x50], 0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov esi, dword [0x55e198]
push edx
push eax
mov dword [esp + 0x24], 0x57a848
call esi
lea ecx, [esp + 0x20]
call fcn.00419050
mov dword [esp + 0x50], 0xffffffff
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x10], 0x57a840
call esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x5628a0
call fcn.0040ee60
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x4c
ret