joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412f80
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x487828
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3328]
mov edi, ecx
cmp byte [edi + 0x10], 0
jne 0x41301f
call fcn.00412760
test al, al
jne 0x41301f
lea eax, [esp + 0x10]
push eax
call fcn.004358e0
add esp, 4
mov ecx, dword [eax]
mov dword [esp + 0x20], 0
call fcn.00427180
mov esi, dword [esp + 0x14]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x413014
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x413014
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x413014
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
push str.CDownloadClient::CreateEmuleTask__ForceExit__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub esp, 0x1c
mov ecx, esp
lea eax, [esp + 0x14c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov dword [esp + 0x2c], esp
mov byte [ecx + 4], 0
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x413044
sub eax, esi
push eax
lea edx, [esp + 0x150]
push edx
call fcn.00402288
mov ecx, edi
call fcn.00411f10
push 0x32fd
call fcn.004518de
add esp, 4
test eax, eax
je 0x413080
mov ecx, eax
call fcn.004113f0
mov esi, eax
jmp 0x413082
xor esi, esi
push 0x32fd
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0045c390
mov ecx, dword [edi + 0x70]
add esp, 0xc
push ebp
push esi
push 0x2662
call fcn.00447f10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 0x3304
Function at 0x4153e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x487e81
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi + 4], 0x4926c8
xor ebx, ebx
mov dword [esi], 0x492ab0
mov dword [esi + 4], 0x4926c8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], ebx
mov byte [esi + 0x18], bl
lea edi, [esi + 0x30]
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.00411ae0
mov dword [edi + 4], eax
mov byte [eax + 0x4d], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
lea edi, [esi + 0x4c]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00428d20
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x41c7f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4889a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0xc], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x74]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x60], ebx
mov byte [ecx + 4], bl
call fcn.0040204d
push ecx
mov ecx, dword [esp + 0x6c]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], esp
call fcn.00419900
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi], edx
mov edx, dword [eax]
push 0xffffffffffffffff
lea ecx, [esi + 0xc]
mov dword [esi + 8], edx
add eax, 4
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx + 4], bl
call fcn.0040204d
cmp dword [esp + 0x2c], 0x10
jb 0x41c8a3
mov eax, dword [esp + 0x18]
push eax
call fcn.00451909
add esp, 4
cmp dword [esp + 0x68], 0x10
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jb 0x41c8c7
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00451909
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x41d730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488a60
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x80]
mov eax, esp
mov dword [esp + 0x14], esp
push ecx
mov dword [eax], ecx
mov eax, esp
mov dword [esp + 0x18], esp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
mov dword [eax], edx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x88]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x74], ebx
mov byte [ecx + 4], bl
call fcn.0040204d
push ecx
mov ecx, dword [esp + 0x80]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], esp
call fcn.0041b260
mov edi, eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esi + 4], eax
mov dword [esi], edx
mov ecx, dword [edi]
mov dword [esi + 8], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0xc]
lea eax, [edi + 4]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x50], 1
mov byte [ecx + 4], bl
call fcn.0040204d
mov edx, dword [edi + 0x20]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 0x24]
mov edi, 0x10
cmp dword [esp + 0x30], edi
mov dword [esi + 0x2c], eax
jb 0x41d819
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00451909
add esp, 4
cmp dword [esp + 0x74], edi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x41d83c
mov edx, dword [esp + 0x60]
push edx
call fcn.00451909
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x421220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x488f99
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi], 0x492c74
mov dword [esp + 0x24], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 3
mov dword [esi + 0x2c], edi
call fcn.00415720
mov ebx, eax
mov dword [esp + 0x14], ebx
call fcn.00484f60
neg ebx
sbb ebx, ebx
test ebx, fcn.004318e0
mov dword [esp + 0x18], eax
je 0x4212b4
push str.mutex
lea ecx, [esp + 0x18]
push ecx
call fcn.0040cc50
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4

Function at 0x4212f0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
push 0xffffffffffffffff
push 0
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4ad8f0
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
push 0
je 0x421341
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
mov edx, dword [esi + 4]
push edx
push fcn.004212e0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret
Function at 0x422420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x489198
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.004053c0
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.0041f7b0
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00476699
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x422517
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.00475f38
mov eax, dword [edi + 4]
test eax, eax
jbe 0x4224f5
cmp eax, 0xffffffff
jae 0x4224f5
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.00475f59
test esi, esi
je 0x422517
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x422558
test edi, edi
je 0x422551
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x42253d
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x42253d
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422546
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422551
mov byte [esp + 0x6d], al
jmp 0x422553
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x42258e
test esi, esi
je 0x42258c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x42257e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x42257e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422587
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x42258e
xor esi, esi
test edi, edi
jne 0x422598
test esi, esi
je 0x42259c
jmp 0x4225a0
test esi, esi
je 0x4225a0
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x4225bd
cmp dword [esp + 0x10], 0
jne 0x4225bd
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x4225c1
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045b0da
add esp, 0x4c
ret 0x28
Function at 0x422600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x489198
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.004053c0
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.0041f7b0
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00476503
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x4226f7
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.00475f38
mov eax, dword [edi + 4]
test eax, eax
jbe 0x4226d5
cmp eax, 0xffffffff
jae 0x4226d5
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.00475f59
test esi, esi
je 0x4226f7
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x422738
test edi, edi
je 0x422731
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x42271d
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x42271d
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422726
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422731
mov byte [esp + 0x6d], al
jmp 0x422733
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x42276e
test esi, esi
je 0x42276c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x42275e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x42275e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422767
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x42276e
xor esi, esi
test edi, edi
jne 0x422778
test esi, esi
je 0x42277c
jmp 0x422780
test esi, esi
je 0x422780
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x42279d
cmp dword [esp + 0x10], 0
jne 0x42279d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x4227a1
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045b0da
add esp, 0x4c
ret 0x28
Function at 0x4227e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48b6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.004053c0
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.0041f7b0
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0045cc5a
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x4228c8
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00475f38
mov eax, dword [edi + 4]
test eax, eax
jbe 0x4228a6
cmp eax, 0xffffffff
jae 0x4228a6
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.00475f59
test esi, esi
je 0x4228c8
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x422909
test edi, edi
je 0x422902
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x4228ee
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x4228ee
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x4228f7
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422902
mov byte [esp + 0x6d], al
jmp 0x422904
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x42293f
test esi, esi
je 0x42293d
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x42292f
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x42292f
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422938
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x42293f
xor esi, esi
test edi, edi
jne 0x422949
test esi, esi
je 0x42294d
jmp 0x422950
test esi, esi
je 0x422950
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x42296d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x422970
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0045b0da
add esp, 0x48
ret 0x28
Function at 0x4229b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48b6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.004053c0
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.0041f7b0
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0045cc83
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x422a98
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00475f38
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422a76
cmp eax, 0xffffffff
jae 0x422a76
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.00475f59
test esi, esi
je 0x422a98
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x422ad9
test edi, edi
je 0x422ad2
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x422abe
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x422abe
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422ac7
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422ad2
mov byte [esp + 0x6d], al
jmp 0x422ad4
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x422b0f
test esi, esi
je 0x422b0d
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x422aff
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x422aff
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422b08
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x422b0f
xor esi, esi
test edi, edi
jne 0x422b19
test esi, esi
je 0x422b1d
jmp 0x422b20
test esi, esi
je 0x422b20
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x422b3d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x422b40
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0045b0da
add esp, 0x48
ret 0x28
Function at 0x422d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48b758
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.004053c0
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.0041fd00
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.0047675c
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x422e7e
push 0
lea ecx, [esp + 0x1c]
call fcn.00475f38
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422e5c
cmp eax, 0xffffffff
jae 0x422e5c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.00475f59
test esi, esi
je 0x422e7e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x422ecb
test edi, edi
je 0x422ec1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x422eaa
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x422eaa
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422eb3
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x422ec1
mov byte [esp + 0x8d], al
jmp 0x422ec3
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x422f07
test esi, esi
je 0x422f05
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x422ef7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x422ef7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x422f00
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x422f07
xor esi, esi
test edi, edi
jne 0x422f30
test esi, esi
je 0x422f34
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x422f3d
cmp dword [esp + 0x14], 0
jne 0x422f3d
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x422f40
test esi, esi
je 0x422f0f
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x422f13
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0045b0da
add esp, 0x6c
ret 0x28