joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ff20
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x553db8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov ecx, esi
call fcn.004f577f
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], 0
lea edi, [esi + 0x18]
mov ecx, edi
mov dword [esi], method.HY.virtual_0
mov dword [esi + 0x10], eax
call fcn.004145f0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov dword [edi], ecx
mov ecx, dword [esp + 0x3c]
mov dword [edi + 4], edx
mov edx, dword [esi + 0x10]
mov dword [edi + 8], eax
push edx
mov dword [edi + 0xc], ecx
call dword [0x55e1b8]
push eax
mov ecx, esi
call fcn.004f5c89
mov ecx, edi
call fcn.00410a70
push eax
mov ecx, edi
call fcn.00416af0
push eax
mov eax, dword [esi + 0x10]
push eax
call dword [0x55e19c]
mov ecx, dword [esi + 4]
push eax
push ecx
mov dword [esi + 0x14], eax
call dword [0x55e198]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x30]
neg edx
push edx
neg eax
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004f5793
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18

Function at 0x4415d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x558a28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x4415fe
xor eax, eax
jmp 0x441601
mov eax, dword [esi + 4]
push edi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00440210
mov dword [esp + 0x50], 0
test esi, esi
jne 0x44161d
xor eax, eax
jmp 0x441620
mov eax, dword [esi + 4]
push edi
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004402d0
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x3c], edx
push 3
lea edx, [esp + 0x34]
mov dword [esp + 0x44], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x70]
push edx
push eax
mov dword [esp + 0x50], ecx
call dword [0x55e160]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [0x55e198]
push ecx
push edx
mov dword [esp + 0x24], 0x57a848
call esi
lea ecx, [esp + 0x20]
call fcn.00419050
mov dword [esp + 0x50], 0xffffffff
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x10], 0x57a840
call esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x5628a0
call fcn.0040ee60
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x4c
ret
Function at 0x449460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x556028
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], 0x57bccc
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0x30]
mov edi, dword [0x55e838]
test eax, eax
je 0x4494ab
push eax
call edi
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x34]
test eax, eax
je 0x4494bc
push eax
call edi
mov dword [esi + 0x34], 0
mov edi, dword [esi + 0x38]
test edi, edi
je 0x4494d2
push edi
call fcn.0044aa80
push edi
call fcn.004dd713
add esp, 4
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004e4da5
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x44d470
Capabilities:
Check os version

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
mov esi, ecx
call fcn.00406fc0
cmp edi, 0xccca
jne 0x44d53a
mov eax, esi
lea esp, [esp]
cmp dword [eax + 0x104], 0
jne 0x44d4ab
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x184]
call eax
test eax, eax
jne 0x44d490
jmp 0x44d4b5
mov edi, dword [eax + 0x104]
test edi, edi
jne 0x44d4cd
push 0x432880
mov ecx, 0x5c0a30
call fcn.004fd855
test eax, eax
jne 0x44d4f5
call fcn.004dd99a
mov eax, dword [edi + 0xa8]
test eax, eax
jne 0x44d4f5
push 0x432880
mov ecx, 0x5c0a30
call fcn.004fd855
test eax, eax
jne 0x44d4ef
call fcn.004dd99a
mov dword [edi + 0xa8], eax
mov ecx, dword [eax + 0x10]
test ecx, ecx
jle 0x44d50e
add ecx, 0xffffffff
js 0x44d4c8
cmp ecx, dword [eax + 0x10]
jge 0x44d4c8
mov edx, dword [eax + 0xc]
mov ecx, dword [edx + ecx*4]
jmp 0x44d510
xor ecx, ecx
cmp ecx, esi
jne 0x44d60f
call fcn.00430250
test eax, eax
jne 0x44d60f
push 1
push esi
mov eax, esi
call fcn.0044e100
push eax
call fcn.004306b0
pop edi
pop esi
ret 4
cmp edi, 0xacd43
jne 0x44d553
mov eax, dword [esi + 0x178]
pop edi
pop esi
mov dword [esp + 4], eax
jmp fcn.004b0c80
cmp edi, 0x1b65f
jne 0x44d5ae
cmp dword [esi + 0x12c], 0
jne 0x44d60f
push edi
mov ecx, esi
call fcn.00410ad0
mov eax, dword [esi + 0xcc]
cmp eax, 0xffffffff
je 0x44d60f
test eax, eax
jl 0x44d59b
mov ecx, esi
call fcn.0044d450
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xf8]
call eax
pop edi
pop esi
ret 4
xor eax, eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xf8]
call eax
pop edi
pop esi
ret 4
cmp edi, 0x1b660
jne 0x44d60f
cmp dword [esi + 0x12c], 0
jne 0x44d60f
push edi
mov ecx, esi
call fcn.00410ad0
mov ecx, dword [esi + 0xd0]
cmp ecx, 0xffffffff
je 0x44d60f
mov eax, dword [esi + 0xcc]
cmp eax, ecx
jne 0x44d60f
test eax, eax
jl 0x44d5e9
mov ecx, esi
call fcn.0044d450
jmp 0x44d5eb
xor eax, eax
push eax
push 0x5bc574
call fcn.004fa263
mov esi, eax
add esp, 8
test esi, esi
je 0x44d60f
call fcn.00490260
test eax, eax
je 0x44d60f
mov edi, esi
call fcn.00499c20
pop edi
pop esi
ret 4
Function at 0x4690b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55470a
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
lea ecx, [esp + 0x24]
call fcn.004145f0
xor esi, esi
mov dword [esp + 0x24], 0x5786e8
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0xa
mov dword [esp + 0x48], esi
mov ecx, dword [ebx + 0x120]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x24]
push edx
push esi
call eax
mov edi, dword [esp + 0x28]
cmp edi, esi
je 0x469188
mov eax, edi
mov eax, dword [eax + 8]
mov edi, dword [edi]
cmp eax, esi
je 0x469138
add eax, 0xffffffe0
jmp 0x46913a
xor eax, eax
test byte [eax + 0xe4], 2
mov edx, dword [esp + 0x50]
mov ecx, dword [ebx + 0x11c]
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
jne 0x46916d
mov dword [esp + 0x14], 1
mov eax, dword [ecx]
mov eax, dword [eax + 0x140]
lea edx, [esp + 0x10]
push edx
push 4
call eax
cmp dword [esp + 0x14], esi
jne 0x4691b4
cmp edi, esi
jne 0x469128
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x4c], 0xffffffff
call fcn.00425670
mov eax, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 8
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x4c], 0xffffffff
call fcn.00425670
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 8
Function at 0x4691e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55470a
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x50]
lea ecx, [esp + 0x24]
call fcn.004145f0
xor esi, esi
mov dword [esp + 0x24], 0x5786e8
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0xa
mov dword [esp + 0x48], esi
mov ecx, dword [ebx + 0x120]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x24]
push edx
push esi
call eax
mov edi, dword [esp + 0x28]
cmp edi, esi
je 0x4692b4
mov eax, edi
mov eax, dword [eax + 8]
mov edi, dword [edi]
cmp eax, esi
je 0x469268
add eax, 0xffffffe0
jmp 0x46926a
xor eax, eax
test byte [eax + 0xe4], 2
mov ecx, dword [ebx + 0x11c]
mov dword [esp + 0x10], 6
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], esi
jne 0x469299
mov dword [esp + 0x14], 1
mov edx, dword [ecx]
mov edx, dword [edx + 0x140]
lea eax, [esp + 0x10]
push eax
push 4
call edx
cmp dword [esp + 0x14], esi
jne 0x4692e0
cmp edi, esi
jne 0x469258
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x4c], 0xffffffff
call fcn.00425670
mov eax, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 4
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x4c], 0xffffffff
call fcn.00425670
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 4
Function at 0x46e3c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x55848d
mov eax, dword fs:[0]
push eax
sub esp, 0x1fc
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push ebp
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x20c]
mov dword fs:[0], eax
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.004e4d7d
xor edi, edi
lea ebx, [esi + 0x44]
mov dword [esp + 0x214], edi
mov ecx, ebx
mov dword [esi], 0x58165c
call fcn.004145f0
lea ecx, [esi + 0x98]
call fcn.004169e0
lea ecx, [esi + 0xa0]
call fcn.004169e0
mov byte [esp + 0x214], 2
mov ebp, 1
push edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call dword [0x55e5f0]
cdq
sub eax, edx
sar eax, 1
push 0x2c
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x64]
push edi
push eax
call fcn.0050cad0
add esp, 0xc
test byte [0x5c0bc8], 1
jne 0x46e4a8
or dword [0x5c0bc8], ebp
push 0x114
push edi
push 0x5c0a90
call fcn.0050cad0
add esp, 0xc
push 0x5c0a90
mov dword [0x5c0a90], 0x114
call dword [0x55e3c8]
mov eax, dword [0x5c0a54]
cmp eax, edi
jne 0x46e4b6
call fcn.00452f30
push edi
push edi
push edi
push edi
or ebp, 0xffffffff
push ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x90], ebp
mov dword [esi + 0x94], ebp
mov dword [esi + 0x38], 1
mov dword [esi + 0x40], 2
call dword [0x55e73c]
push 0x1f4
lea ecx, [esp + 0x18]
push edi
push ecx
mov dword [esi + 0x58], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x5c], ebp
call fcn.0050cad0
add esp, 0xc
push edi
lea edx, [esp + 0x18]
push edx
push 0x1f4
push 0x29
mov dword [esp + 0x24], 0x1f4
call dword [0x55e74c]
lea eax, [esp + 0x150]
push eax
lea ecx, [esi + 0x98]
mov dword [esp + 0x164], 0x190
call fcn.00416490
lea ecx, [esp + 0x150]
push ecx
lea ecx, [esi + 0xa0]
mov dword [esp + 0x164], 0x2bc
call fcn.00416490
mov eax, esi
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.0050c749
add esp, 0x208
ret
Function at 0x475880
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55470a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
mov ebp, dword [esp + 0x58]
xor edi, edi
cmp eax, 1
je 0x4758bf
cmp eax, 3
je 0x4758bf
xor ebx, ebx
jmp 0x4758c4
mov ebx, 1
cmp eax, edi
je 0x4758d1
mov dword [esp + 0x5c], edi
cmp eax, 1
jne 0x4758d9
mov dword [esp + 0x5c], 1
lea ecx, [esp + 0x24]
call fcn.004145f0
mov dword [esp + 0x24], 0x5786e8
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0xa
push edi
push edi
lea esi, [esp + 0x2c]
mov dword [esp + 0x50], edi
call fcn.00425570
mov ecx, dword [esp + 0x54]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
je 0x475928
mov dword [ecx], eax
jmp 0x47592c
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x24]
cmp ebx, edi
je 0x47595c
push edi
push eax
call fcn.00425570
mov dword [eax + 8], ebp
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
je 0x475952
mov dword [ecx], eax
mov dword [esp + 0x2c], eax
jmp 0x47597f
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
jmp 0x47597f
mov edx, dword [esp + 0x28]
push edx
push edi
call fcn.00425570
mov dword [eax + 8], ebp
mov ecx, dword [esp + 0x28]
cmp ecx, edi
je 0x475977
mov dword [ecx + 4], eax
jmp 0x47597b
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
lea esi, [esp + 0x14]
call fcn.00479880
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x50]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x6c]
push ebp
push eax
lea eax, [esp + 0x3c]
call fcn.004755c0
add esp, 0x18
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x4c], 0xffffffff
call fcn.00425670
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x47fb30
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x55829a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x14], 0
mov eax, dword [ecx]
mov edx, dword [eax + 0x140]
call edx
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov edi, dword [esi + 0x78]
mov ebp, eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x48]
test ebp, ebp
je 0x47fba3
call fcn.00416af0
jmp 0x47fba8
call fcn.00410a70
mov ecx, dword [esi + 0x1ac]
sub eax, edi
dec eax
test ebp, ebp
je 0x47fbe7
sub dword [esp + 0x28], eax
mov eax, dword [esi + 0x4c]
add dword [esp + 0x20], ecx
cmp eax, 0xffffffff
jne 0x47fbc8
mov eax, dword [esi + 0x48]
push eax
lea ecx, [esp + 0x4c]
call fcn.00410a70
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x30]
add eax, 2
push eax
push ecx
push edx
jmp 0x47fc15
add dword [esp + 0x24], ecx
sub ebx, eax
mov eax, dword [esi + 0x4c]
mov dword [esp + 0x2c], ebx
cmp eax, 0xffffffff
jne 0x47fbfc
mov eax, dword [esi + 0x48]
push eax
add ebx, 2
push ebx
lea ecx, [esp + 0x50]
call fcn.00416af0
mov ecx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x58]
push eax
push ecx
mov edi, dword [esp + 0x54]
mov ecx, edi
call fcn.004fcabc
mov edx, dword [esp + 0x44]
mov ecx, dword [edx + 0x1a4]
test ecx, ecx
je 0x47fc49
mov eax, dword [ecx]
mov eax, dword [eax + 0x54]
lea edx, [esp + 0x1c]
push edx
call eax
mov dword [esp + 0x38], 0
mov ebx, 1
jmp 0x47fc64
push 0x574340
lea ecx, [esp + 0x44]
call fcn.004039f0
mov dword [esp + 0x38], 1
mov ebx, 2
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00402400
mov dword [esp + 0x38], 2
test bl, 2
je 0x47fc8b
lea ecx, [esp + 0x40]
and ebx, 0xfffffffd
call fcn.00408b90
mov byte [esp + 0x38], 4
test bl, 1
je 0x47fc9e
lea ecx, [esp + 0x1c]
call fcn.00408b90
cmp dword [esi + 0x24], 0
je 0x47fcb8
mov ecx, dword [esp + 0x44]
cmp dword [ecx + 0x194], 0
je 0x47fcb8
mov eax, 1
jmp 0x47fcba
xor eax, eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
mov edx, dword [esi]
mov edx, dword [edx + 0x7c]
push ebp
push eax
lea eax, [esp + 0x20]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov ebx, dword [esp + 0x40]
mov dword [eax + 4], ebx
mov ebx, dword [esp + 0x44]
add ecx, 0x54
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x48]
push ecx
push edi
mov ecx, esi
mov dword [eax + 0xc], ebx
call edx
lea ecx, [esp + 0x18]
call fcn.00408b90
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
Function at 0x48c730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55b5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, esi
and eax, 0x40ffff
mov dword [edi + 0x54], eax
test eax, 0x2800
jne 0x48c7f0
test eax, 0x8200
jne 0x48c7fe
test eax, 0x1400
jne 0x48c7f7
mov eax, 0x585348
push eax
lea ecx, [esp + 0x10]
call fcn.004039f0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.004145f0
lea eax, [esp + 0x10]
push eax
call dword [0x55e770]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push 0
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.00406440
push eax
push 0x585238
mov ecx, edi
call fcn.004df322
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.00408b90
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8
mov eax, 0x585300
jmp 0x48c782
mov eax, 0x585314
jmp 0x48c782
mov eax, 0x58532c
jmp 0x48c782
Function at 0x4ab2b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x557200
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, 0x55
mov edi, edx
mov edx, eax
mov ecx, 0xaa
mov word [esp + 0x28], ax
mov eax, ecx
mov word [esp + 0x2a], cx
mov ecx, edx
mov word [esp + 0x2c], dx
mov edx, eax
mov word [esp + 0x2e], ax
mov eax, ecx
mov word [esp + 0x30], cx
mov ecx, edx
mov word [esp + 0x36], cx
lea ecx, [esp + 0x1c]
mov word [esp + 0x32], dx
mov word [esp + 0x34], ax
call fcn.0040f030
lea edx, [esp + 0x28]
push edx
push 1
push 1
push 8
push 8
mov dword [esp + 0x5c], 0
call dword [0x55e120]
push eax
lea ecx, [esp + 0x20]
call fcn.004f5f5b
lea ecx, [esp + 0xc]
call fcn.0040ee00
mov dword [esp + 0xc], 0x562880
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 1
call fcn.00411740
push eax
call dword [str._bj_jxj]
push eax
lea ecx, [esp + 0x10]
call fcn.004f5f5b
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004f6046
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x220]
cmp eax, 0xffffffff
jne 0x4ab3a7
mov eax, dword [ebx + 0x21c]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x2c]
mov ecx, esi
call eax
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x25c]
cmp eax, 0xffffffff
jne 0x4ab3c8
mov ebx, dword [ebx + 0x258]
jmp 0x4ab3ca
mov ebx, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
push ebx
mov ecx, esi
call eax
mov ecx, edi
mov ebx, eax
call fcn.00410a70
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.00416af0
mov edx, dword [esp + 0x24]
mov ecx, dword [edi + 4]
mov edi, dword [edi]
push 0xf00021
push edx
push eax
mov eax, dword [esi + 4]
push ecx
push edi
push eax
call dword [0x55e118]
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004f6046
mov edx, dword [esi]
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 0x2c]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebx
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
call fcn.004f5fb3
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 0
call fcn.00419050
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 0xffffffff
call fcn.0040ede0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0050c749
mov esp, ebp
pop ebp
ret
Function at 0x4bdab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x557eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0x14]
call fcn.004145f0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00410a90
mov al, byte [esi + 0x1d8]
cmp al, 0xff
jne 0x4bdb08
mov ecx, esi
call fcn.004e3e8f
and al, 0xf
cmp al, 7
jne 0x4bdb88
cmp dword [esi + 0x60], 0
jne 0x4bdb88
cmp dword [esi + 0x64], 0
jne 0x4bdb88
mov ebx, dword [edi]
mov ecx, esi
call fcn.004164e0
mov edx, dword [ebx + 0x28]
push eax
mov ecx, edi
call edx
mov ecx, dword [esi + 0x58]
mov edx, dword [ecx + 0x38]
mov ecx, dword [edx + 0x74]
mov ebx, eax
mov eax, dword [edi]
mov edx, dword [eax + 0x2c]
push ecx
mov ecx, edi
call edx
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x168]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 0xc], ecx
push edi
mov ecx, esi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ebx
mov ecx, edi
call edx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x4bdb8f
mov edi, dword [edi + 4]
push edi
lea eax, [esp + 0x28]
push eax
lea ebx, [esp + 0x1c]
call fcn.0043fc40
push 0x135
mov ecx, ebx
mov dword [esp + 0x64], 0
call fcn.004145f0
push eax
lea ebx, [esp + 0x2c]
call fcn.004b4340
mov ecx, esi
call fcn.004164e0
push eax
mov ecx, ebx
call fcn.004f6046
push 1
mov ecx, ebx
mov edi, eax
call fcn.004f54b9
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x168]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 0xc], ecx
mov eax, ebx
push eax
mov ecx, esi
call edx
push edi
mov ecx, ebx
call fcn.004f6046
mov ecx, ebx
mov dword [esp + 0x60], 0xffffffff
call fcn.0043fe70
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c4690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x555369
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [str.._AVCInvalidArgException__]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.004e4d7d
xor ebx, ebx
lea ebp, [esi + 0x44]
mov dword [esp + 0x1c], ebx
mov ecx, ebp
mov dword [esi], 0x58bb6c
call fcn.004145f0
lea ecx, [esi + 0x54]
call fcn.00402010
lea ecx, [esi + 0x58]
call fcn.00402010
lea edi, [esi + 0x6c]
mov ecx, edi
call fcn.004145f0
mov dword [edi], 0x58bc68
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov ecx, esi
mov byte [esp + 0x1c], 3
call fcn.0050822e
or eax, 0xffffffff
mov edi, 1
push ebp
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x40], ebx
call dword [0x55e770]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x68], edi
mov dword [esi + 0x60], ebx
mov dword [esi + 0x80], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4