joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403430
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 0x24
lea eax, [esp + 0x14]
push esi
push eax
call dword [0x48a3ec]
xor esi, esi
push esi
call dword [0x48a8a0]
test eax, eax
jl 0x40359d
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [0x48a8a4]
cmp eax, esi
jge 0x403470
cmp eax, 0x80010119
jne 0x403597
lea eax, [esp + 8]
mov dword [esp + 8], esi
push eax
push 0x4930d4
push 1
push esi
push 0x4931a4
call dword [0x48a8a8]
test eax, eax
jl 0x403597
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push esi
push esi
push esi
push esi
push esi
mov dword [esp + 0x1c], esi
mov ecx, dword [eax]
push esi
push str.ROOTCIMV2
push eax
call dword [ecx + 0xc]
test eax, eax
jge 0x4034ee
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [0x48a8ac]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov edx, eax
pop esi
mov dword [edx], ecx
mov ecx, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 0xc], ecx
add esp, 0x24
ret 4
mov edx, dword [esp + 4]
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push edx
call dword [0x48a8b0]
test eax, eax
jge 0x40351d
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x403597
mov eax, dword [esp + 4]
lea edx, [esp + 0xc]
push edx
push esi
push 0x10
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov ecx, dword [eax]
push str.SELECT__from_Win32_BaseBoard
push 0x4a0394
push eax
call dword [ecx + 0x50]
test eax, eax
jge 0x40355b
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x403597
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x403597
push edi
push str.Product
call dword [0x48a3e8]
mov ecx, dword [esp + 0x14]
push esi
lea edi, [esp + 0x20]
push esi
mov edx, dword [ecx]
push edi
push esi
push eax
push ecx
call dword [edx + 0x10]
pop edi
call dword [0x48a8ac]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov ecx, eax
pop esi
mov dword [ecx], edx
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x20]
mov dword [ecx + 0xc], edx
add esp, 0x24
ret 4
Function at 0x404c50
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x220]
test edi, edi
je 0x404c98
cmp edi, 1
je 0x404c98
cmp edi, 2
je 0x404c98
cmp edi, 3
je 0x404c98
cmp edi, 4
je 0x404c98
cmp edi, 5
jne 0x404c9d
mov ebx, 1
mov edx, dword [esi + 0x124]
xor eax, eax
test edx, edx
jle 0x404cc4
mov ecx, dword [esi + 0x120]
add ecx, 0x820
cmp edi, dword [ecx]
je 0x404cd7
inc eax
add ecx, 0x828
cmp eax, edx
jl 0x404cb5
test ebx, ebx
jne 0x404cd7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret 4
cmp dword [esi + 0x104], edi
je 0x404e8e
mov dword [esi + 0x104], edi
mov eax, dword [esi + 0x110]
xor ebx, ebx
test eax, eax
jle 0x404d9a
mov ebp, dword [0x48a59c]
mov eax, dword [esi + 0x10c]
mov eax, dword [eax + ebx*4]
cmp dword [eax], edi
jne 0x404d83
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [eax + 4]
call fcn.00414ef0
test eax, eax
jne 0x404d41
test edi, edi
je 0x404d39
cmp edi, 3
je 0x404d39
cmp edi, 4
je 0x404d39
cmp edi, 5
mov dword [esp + 0x10], edi
jne 0x404d41
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.004061a0
mov ecx, eax
call fcn.00409360
mov edx, dword [esi + 0x10c]
push 5
mov eax, dword [edx + ebx*4]
mov ecx, dword [eax + 0x20]
push ecx
call ebp
mov edx, dword [esi + 0x10c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, dword [edx + ebx*4]
push 0xffffffffffffffff
add ecx, 4
call fcn.00413cc0
jmp 0x404d8b
mov eax, dword [eax + 0x20]
push 0
push eax
call ebp
mov eax, dword [esi + 0x110]
inc ebx
cmp ebx, eax
jl 0x404cff
cmp edi, 5
ja case.default.0x404da3
jmp dword [edi*4 + 0x404ea0]
push 0x17
mov ecx, esi
call fcn.00404ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push 0x19
mov ecx, esi
call fcn.00404ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push 0x15
mov ecx, esi
call fcn.00404ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push 0x1b
mov ecx, esi
call fcn.00404ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push 0x1d
mov ecx, esi
call fcn.00404ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push 0x13
mov ecx, esi
call fcn.00404ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
mov eax, dword [esi + 0x124]
xor ebp, ebp
test eax, eax
jle 0x404e8e
xor ebx, ebx
mov ecx, dword [esi + 0x120]
lea eax, [ecx + ebx]
mov ecx, dword [ecx + ebx + 0x820]
cmp edi, ecx
jne 0x404e7d
mov dx, word [eax + 0x824]
mov ecx, esi
push edx
call fcn.00404ff0
mov eax, dword [esi + 0x124]
inc ebp
add ebx, 0x828
cmp ebp, eax
jl 0x404e5a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
Function at 0x4088a0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20c
lea ecx, [esp + 4]
push esi
push edi
push eax
push 0x4a0e90
push ecx
call fcn.00462c4e
add esp, 0xc
call fcn.00411b40
mov esi, eax
lea edx, [esp + 8]
neg esi
sbb esi, esi
push edx
push 0x20006
add esi, 0x80000002
push 0
push str.SOFTWAREASUSLifeFrame
push esi
call dword [0x48a00c]
mov edi, dword [0x48a004]
test eax, eax
je 0x408931
mov eax, dword [esp + 8]
push eax
call edi
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREASUSLifeFrame
push esi
call dword [0x48a010]
test eax, eax
je 0x408931
mov edx, dword [esp + 8]
push edx
call edi
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
mov edx, dword [esp + 8]
lea eax, [esp + 0x21c]
push 4
push eax
push 4
lea ecx, [esp + 0x18]
push 0
push ecx
push edx
call dword [0x48a008]
test eax, eax
je 0x408967
mov eax, dword [esp + 8]
push eax
call edi
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
mov ecx, dword [esp + 8]
push ecx
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret 8

Function at 0x408980
Capabilities:
Set registry value

Disassembly:
push ecx
call fcn.00411b40
neg eax
lea ecx, [esp]
sbb eax, eax
push ecx
push 0x20006
add eax, 0x80000002
push 0
push str.SOFTWAREASUSLifeFrame
push eax
call dword [0x48a00c]
test eax, eax
jne 0x4089e6
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.00462ddc
mov edx, dword [esp + 0x10]
add esp, 4
shl eax, 1
push eax
mov eax, dword [esp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [0x48a008]
mov ecx, dword [esp + 4]
push ecx
call dword [0x48a004]
mov eax, 1
pop esi
pop ecx
ret 8
xor eax, eax
pop ecx
ret 8

Function at 0x4089f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [esp + 0x214]
lea ecx, [esp + 8]
push eax
push 0x4a0e90
push ecx
call fcn.00462c4e
add esp, 0xc
mov dword [esp + 4], 4
call fcn.00411b40
neg eax
lea edx, [esp]
sbb eax, eax
push edx
push 0x20019
add eax, 0x80000002
push 0
push str.SOFTWAREASUSLifeFrame
push eax
call dword [0x48a00c]
test eax, eax
je 0x408a58
mov eax, dword [esp]
push eax
call dword [0x48a004]
xor eax, eax
add esp, 0x210
ret 8
mov edx, dword [esp + 0x218]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push 0
push eax
push ecx
call dword [0x48a014]
test eax, eax
je 0x408a93
mov edx, dword [esp]
push edx
call dword [0x48a004]
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
push eax
call dword [0x48a004]
mov eax, 1
add esp, 0x210
ret 8
Function at 0x40b1a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x794
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xdb4]
cmp eax, 3
je 0x40b1be
cmp eax, 1
jne 0x40b41a
mov eax, dword [esi + 0xdb8]
test eax, eax
jne 0x40b41a
mov eax, dword [esi + 0x1d0c]
test eax, eax
je 0x40b41a
mov eax, dword [esi + 0x1d58]
test eax, eax
je 0x40b41a
mov eax, dword [esi + 0x1d5c]
test eax, eax
je 0x40b41a
push ebx
push 1
mov ecx, esi
call fcn.0040b430
mov eax, dword [esi + 0x1cc0]
mov ebx, dword [0x48a5b4]
test eax, eax
je 0x40b219
push 0
push 0
push 0x10
push eax
call ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x192]
mov word [esp + 0x190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x190]
push eax
call fcn.00436840
lea ecx, [esp + 0x194]
push str.camera.wav
push ecx
call fcn.00462d8d
add esp, 0xc
call fcn.004810f5
mov eax, dword [eax + 8]
lea edx, [esp + 0x190]
push edx
push 0x4000410f
push eax
mov eax, dword [esi + 8]
push eax
call sub.MSVFW32.dll_MCIWndCreateW
add esp, 0x10
mov dword [esi + 0x1cc0], eax
push 0
push 0
push 0x47a
push eax
call ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov di, word [esp + 0x7a4]
pop ebx
cmp di, 1
jne 0x40b314
lea ecx, [esp + 0xc]
push ecx
push 0
mov ecx, esi
call fcn.0040dc20
push 0
push 0
lea edx, [esp + 0x114]
push 0x80
push edx
lea eax, [esp + 0x1c]
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [0x48a34c]
lea ecx, [esp + 0x10c]
push ecx
call dword [esi + 0x1d58]
add esp, 4
test eax, eax
je 0x40b41a
mov edx, dword [esi + 0x2038]
push 0
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esi + 0x242c]
call fcn.004454b0
jmp 0x40b37e
cmp di, 4
jne 0x40b347
lea ecx, [esp + 8]
push ecx
call dword [esi + 0x1d5c]
add esp, 4
test eax, eax
je 0x40b37e
mov edx, dword [esp + 8]
push edx
call fcn.004287e0
mov ecx, eax
call fcn.00428c30
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40b37e
jmp 0x40b378
cmp di, 2
jne 0x40b37e
lea ecx, [esp + 8]
push ecx
call dword [esi + 0x1d5c]
add esp, 4
test eax, eax
je 0x40b37e
mov edx, dword [esp + 8]
push edx
call fcn.00439c20
mov ecx, eax
call fcn.00439dd0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40b37e
mov eax, dword [ecx]
push 1
call dword [eax]
push 0
mov ecx, esi
call fcn.0040b430
cmp di, 1
jne 0x40b40a
push 0x4a102c
lea ecx, [esi + 0x40]
call fcn.00403380
test eax, eax
je 0x40b40a
push 1
lea ecx, [esp + 0x390]
push 0x27
push ecx
push 0
call dword [0x48a434]
lea edx, [esp + 0x594]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.00436b00
add esp, 8
test eax, eax
je 0x40b40a
lea ecx, [esp + 0x38c]
push 0x4a1028
push ecx
call fcn.00462d8d
lea edx, [esp + 0x59c]
lea eax, [esp + 0x394]
push edx
push eax
call fcn.00462d8d
add esp, 0x10
lea ecx, [esp + 0x38c]
lea edx, [esp + 0xc]
push 1
push ecx
push edx
call dword [0x48a348]
pop edi
mov eax, 1
pop esi
add esp, 0x794
ret 4
pop edi
xor eax, eax
pop esi
add esp, 0x794
ret 4
Function at 0x4102d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
push esi
mov esi, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
call fcn.00436840
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0x218]
push ecx
push edx
stosw word es:[edi], ax
call fcn.00462db7
lea eax, [esp + 0x220]
push str.AutoPlayer.exe
push eax
call fcn.00462d8d
add esp, 0x14
lea ecx, [esp + 0xc]
lea edx, [esp + 0x214]
push 5
push ecx
push str._run
push edx
push str.open
push 0
call dword [0x48a438]
cmp eax, 0x20
jg 0x4103ec
cmp eax, 2
jne 0x4103ac
lea eax, [esp + 8]
push str.IDS_MSG_FILENOTFOUND
push eax
call fcn.0043a460
mov ecx, eax
call fcn.0043a5b0
mov ecx, dword [esp + 8]
mov edx, dword [esi + 8]
push 0
push str.Life_Frame
push ecx
push edx
call dword [0x48a588]
lea ecx, [esp + 8]
call fcn.0047b122
pop edi
xor eax, eax
pop esi
add esp, 0x414
ret
lea eax, [esp + 8]
push str.IDS_MSG_AUTOPLAYERERROR
push eax
call fcn.0043a460
mov ecx, eax
call fcn.0043a5b0
mov ecx, dword [esp + 8]
mov edx, dword [esi + 8]
push 0
push str.Life_Frame
push ecx
push edx
call dword [0x48a588]
lea ecx, [esp + 8]
call fcn.0047b122
pop edi
xor eax, eax
pop esi
add esp, 0x414
ret
pop edi
mov eax, 1
pop esi
add esp, 0x414
ret
Function at 0x411c80
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x411c9f
mov eax, dword [ecx + 0x2448]
push 5
push eax
call dword [0x48a59c]
mov eax, 1
ret 4
mov ecx, dword [ecx + 0x2448]
push 0
push ecx
call dword [0x48a59c]
mov eax, 1
ret 4
Function at 0x416cb0
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
push 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [0x48a8a0]
lea eax, [esp + 0xc]
push eax
push 0x48eb10
push 1
push 0
push 0x48eb30
call dword [0x48a8a8]
test eax, eax
jl 0x416dd6
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 0
push edx
mov ecx, dword [eax]
push 0x48eb20
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x416d1a
mov eax, dword [esp + 0xc]
jmp 0x416dd0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x416dc2
mov ebp, dword [esp + 0x30]
mov esi, dword [0x48a3ec]
mov edi, dword [0x48a3f0]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x30]
push ecx
push 0x492980
mov edx, dword [eax]
push 0
push 0
push eax
call dword [edx + 0x24]
test eax, eax
jl 0x416da8
lea edx, [esp + 0x1c]
push edx
call esi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1c]
push 0
push edx
mov ecx, dword [eax]
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x416d97
mov eax, dword [esp + 0x24]
push eax
push ebp
call fcn.00462e49
add esp, 8
test eax, eax
je 0x416de7
lea ecx, [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x30]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x416d48
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [0x48a8ac]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret 4
lea eax, [esp + 0x1c]
push eax
call edi
mov eax, dword [esp + 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [0x48a8ac]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x20
ret 4
Function at 0x416ef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x428]
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi + 0x228], ebx
call fcn.00411b40
test eax, eax
je 0x416f5a
push 1
lea eax, [esp + 0x21c]
push 0x23
push eax
push 0
call dword [0x48a434]
lea ecx, [esp + 0x218]
push ebx
push ecx
lea edx, [esi + 0x22c]
push str._sASUSLifeFrameconfig_i.cfg
push edx
call fcn.00462c4e
add esp, 0x10
lea eax, [esp + 0x218]
lea ecx, [esi + 0x434]
push ebx
push eax
push str._sASUSLifeFrame_tmp_i.img
push ecx
jmp 0x416fa9
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push edx
stosw word es:[edi], ax
call fcn.00436840
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esi + 0x22c]
push ebx
push eax
push str._sconfig_i.cfg
push ecx
call fcn.00462c4e
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esi + 0x434]
push ebx
push edx
push str._s_tmp_i.img
push eax
call fcn.00462c4e
mov eax, dword [esp + 0x434]
add esp, 0x10
test eax, eax
jne 0x416fc9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret 0x14
lea ebp, [esi + 0x63c]
push eax
push ebp
call fcn.00462db7
mov ecx, dword [esp + 0x438]
add esp, 8
mov dword [esi + 0x844], ecx
mov ecx, esi
call fcn.00417fb0
test eax, eax
jne 0x417022
push ebp
mov ecx, esi
call fcn.004170c0
test eax, eax
jne 0x41700a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret 0x14
mov ecx, esi
call fcn.00417bd0
test eax, eax
jne 0x417022
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret 0x14
mov ecx, esi
call fcn.004186b0
test eax, eax
jne 0x417034
mov ecx, esi
call fcn.00418280
mov ecx, esi
call fcn.004187c0
test eax, eax
jne 0x41704c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret 0x14
mov edi, dword [esp + 0x428]
mov edx, dword [esp + 0x42c]
lea ebx, [edi + edx]
cmp edi, ebx
jge 0x41706e
push edi
mov ecx, esi
call fcn.00417920
inc edi
cmp edi, ebx
jl 0x417061
push 0x20c
call fcn.0047ae5b
mov edi, eax
mov eax, dword [esi + 0x844]
push ebp
lea ecx, [edi + 4]
mov dword [edi], eax
push ecx
call fcn.00462db7
add esp, 0xc
push 0
push 0
push edi
push 0x418440
push 0
push 0
call dword [0x48a364]
pop edi
pop esi
mov dword [0x4acc50], eax
pop ebp
mov eax, 1
pop ebx
add esp, 0x410
ret 0x14
Function at 0x418280
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x250
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x63c]
push eax
call dword [0x48a384]
lea ecx, [esp + 0x10]
xor ebp, ebp
push ecx
push 0x4a1420
mov dword [esi + 0x10], ebp
call dword [0x48a128]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4182c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x250
ret
lea edx, [esp + 0x3c]
mov ecx, esi
push edx
call fcn.00417390
test eax, eax
jl 0x4182de
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
call fcn.00417770
mov ebx, dword [0x48a1a4]
lea ecx, [esp + 0x10]
push ecx
push edi
call ebx
test eax, eax
je 0x418318
lea edx, [esp + 0x3c]
mov ecx, esi
push edx
call fcn.00417390
test eax, eax
jl 0x41830c
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
call fcn.00417770
lea ecx, [esp + 0x10]
push ecx
push edi
call ebx
test eax, eax
jne 0x4182f0
push edi
call dword [0x48a338]
mov ecx, esi
call fcn.00418550
test eax, eax
jne 0x418345
mov edx, dword [esi + 0x10]
mov ecx, esi
push edx
call fcn.00418520
mov dword [esi + 0x10], ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x250
ret
mov eax, dword [esi]
mov ecx, esi
push eax
call fcn.00418520
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x10], ebp
mov dword [esi], ecx
mov ecx, esi
call fcn.00417db0
push ebp
mov dword [esi + 4], eax
call dword [0x48a5a8]
mov edx, dword [esi + 8]
mov ebx, dword [0x48a120]
push edx
mov edi, eax
call ebx
mov eax, dword [esi + 0xc]
mov ebp, dword [0x48a048]
push eax
call ebp
push edi
call dword [0x48a050]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
lea ecx, [eax + eax*4]
shl ecx, 2
push ecx
push 0x50
push edi
call dword [0x48a0c4]
mov edx, dword [esi + 8]
push eax
push edx
mov dword [esi + 0xc], eax
call dword [0x48a03c]
mov eax, dword [esi + 0x14]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
lea eax, [eax + eax*2]
lea ecx, [eax + eax*4]
shl ecx, 2
push ecx
push 0x50
push 0
push 0
push edx
call dword [0x48a0ac]
mov eax, dword [esi + 0x18]
push eax
call ebp
mov ecx, dword [esi + 0x14]
xor ebp, ebp
push ecx
mov dword [esi + 0x18], ebp
call ebx
push edi
push ebp
mov dword [esi + 0x14], ebp
call dword [0x48a5ac]
mov eax, dword [0x4acc4c]
cmp eax, ebp
je 0x418413
mov edi, eax
cmp edi, ebp
je 0x418413
mov edx, dword [edi]
push edx
call sub.gdiplus.dll_GdipDeleteGraphics
push edi
call sub.gdiplus.dll_GdipFree
mov eax, dword [esi + 8]
push eax
call fcn.00418d40
add esp, 4
mov ecx, esi
mov dword [0x4acc4c], eax
call fcn.00417dd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x250
ret
Function at 0x419440
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x485150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x38]
lea edi, [esi + 0x60]
push edi
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x3c], eax
call fcn.004061a0
mov ecx, eax
call fcn.00409eb0
test eax, eax
jne 0x419488
mov dword [edi], 0xffffffff
call fcn.004061a0
mov ecx, eax
call fcn.00408280
mov eax, dword [eax]
push eax
call dword [0x48a0c8]
mov edi, eax
push 0
push edi
push 0
push 0
call fcn.004789f4
push eax
lea ecx, [esp + 0x3c]
call fcn.0047b196
push edi
mov byte [esp + 0x2c], 1
call dword [0x48a048]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esi + 0x78]
call fcn.0047b269
push 0x7d
push 0x6f
push 0
lea edx, [esp + 0x1c]
push 0
push edx
call dword [0x48a5a4]
mov ebx, dword [0x48a5a0]
lea eax, [esp + 0x10]
lea ecx, [esi + 0x40]
push eax
push ecx
call ebx
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [edi]
mov eax, dword [edi + 8]
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [edi + 4]
sar eax, 1
sub edx, ebp
lea eax, [eax + ecx - 0x37]
mov ecx, dword [esp + 0x14]
add edx, ecx
push edx
push eax
lea eax, [esp + 0x18]
push eax
call dword [0x48a528]
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
push 0
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x80000000
push 0
push edx
push 0
mov ecx, esi
call fcn.00478272
test eax, eax
jne 0x41957a
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], al
call fcn.0047b122
lea ecx, [esp + 0x40]
mov dword [esp + 0x28], 0xffffffff
call fcn.0047b122
xor eax, eax
jmp 0x4195fe
mov eax, dword [esi + 0x1c]
push eax
call dword [0x48a5a8]
push eax
mov dword [esi + 0x74], eax
call dword [0x48a050]
mov ecx, dword [esi + 0x4c]
mov edx, dword [esi + 0x48]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x74]
push ecx
push edx
push eax
call dword [0x48a0c4]
mov ecx, dword [esi + 0x6c]
push eax
push ecx
mov dword [esi + 0x70], eax
call dword [0x48a03c]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004196a0
mov edx, dword [esi + 0x1c]
push 0x80000
push 0x64
push edx
call dword [0x48a524]
lea ebp, [esi + 0x50]
push edi
push ebp
call ebx
push ebp
mov ecx, esi
call fcn.0047e6b7
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 0
call fcn.0047b122
lea ecx, [esp + 0x40]
mov dword [esp + 0x28], 0xffffffff
call fcn.0047b122
mov eax, 1
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x14