joyce8/EMBER2024-capa huggingface dataset:
Function at 0x83d470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xa5e408
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov dword [eax + 0xc], ebx
mov dword [esi + 0x500], ebx
mov dword [esi + 0x504], ebx
mov ecx, dword [eax]
mov edi, dword [eax + 8]
add ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x4f8]
push edi
push ecx
add eax, ebx
push eax
call fcn.00a2b930
add dword [esi + 0x500], edi
add esp, 0xc
call fcn.00626140
mov ebp, eax
mov dword [esp + 0x28], ebp
mov byte [ebp], bl
mov ecx, dword [0xce1d00]
mov edx, dword [esp + 0x24]
mov edi, dword [ecx + 0x570]
push edx
mov ecx, 0xce48a0
mov dword [esp + 0x20], ebx
call fcn.004aae20
push eax
push str.Warning_DropItem
push str.CardIdentifyStrings
mov ecx, 0xdacba0
call fcn.008e2ac0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00417090
add esp, 0xc
push str.Warning
push str.WordStrings
mov ecx, 0xdacba0
mov ebx, eax
call fcn.008e2ac0
mov ecx, dword [edi + 0x82c4]
push 1
push 0xff
push 1
push 1
push 3
push ebx
push eax
push esi
call fcn.00872f90
mov eax, dword [edi + 0x82c4]
mov dword [eax + 0x2f8], 0x15
push ebp
mov dword [edi + 0x82c8], esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00626120
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x84b350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ecx + 0x404]
test ecx, ecx
je 0x84b35f
jmp fcn.00853150
ret
Function at 0x850650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0xcdc190]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xb052dc]
movzx edx, byte [0xb052e4]
mov ebx, dword [esp + 0x90]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov word [esp + 0x39], ax
mov byte [esp + 0x3b], al
mov eax, dword [0xb052f4]
mov esi, ecx
mov ecx, dword [0xb052e0]
mov byte [esp + 0x24], dl
movzx edx, byte [0xb052fc]
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [0xb052f8]
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov dword [esp + 0x55], eax
mov word [esp + 0x59], ax
mov byte [esp + 0x5b], al
mov eax, dword [str.TXTbar_4]
mov dword [esp + 0x40], ecx
mov ecx, dword [0xb05304]
mov byte [esp + 0x44], dl
movzx edx, byte [0xb05308]
mov dword [esp + 0x5c], eax
xor eax, eax
push str.UsrGroom
mov dword [esp + 0x64], ecx
push str.CoupleUIParams
mov ecx, 0xdacba0
mov byte [esp + 0x6c], dl
mov dword [esp + 0x6d], eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
mov dword [esp + 0x79], eax
mov dword [esp + 0x7d], eax
mov word [esp + 0x81], ax
mov byte [esp + 0x83], al
call fcn.008e2b00
push str.UsrBride
push str.CoupleUIParams
mov ecx, 0xdacba0
mov dword [esp + 0x18], eax
call fcn.008e2b00
push str.UsrGuest
push str.CoupleUIParams
mov ecx, 0xdacba0
mov dword [esp + 0x1c], eax
call fcn.008e2b00
mov edi, dword [esp + 0x8c]
mov ecx, edi
shl ecx, 5
lea edx, [esp + ecx + 0x1c]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov ebp, dword [eax]
push edx
call fcn.00572410
mov ecx, dword [esi]
push eax
mov eax, dword [ebp + 0x98]
call eax
mov ecx, dword [esp + edi*4 + 0x10]
push 0
push 1
push 0
push ecx
mov ecx, dword [esi]
call fcn.0089d0e0
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
push 1
call eax
mov ecx, dword [esi + 4]
mov ebp, dword [ecx]
mov ecx, dword [esi + 0xc]
push str.TXTbar_2
call fcn.00572410
mov ecx, dword [esi + 4]
mov edx, dword [ebp + 0x98]
push eax
call edx
mov ecx, dword [esi + 4]
push 0
push 1
push 0
push ebx
call fcn.0089d0e0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x3c]
push 1
call edx
cmp edi, 2
jne 0x850801
cmp byte [esp + 0x94], 0
je 0x850801
push 1
jmp 0x850803
push 0
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x3c]
call edx
mov eax, dword [esp + 0x98]
mov ecx, dword [esi + 8]
push 1
push eax
call fcn.0089b200
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x88]
pop edi
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x78]
mov dword [esi + 0x14], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a2a4ac
add esp, 0x70
ret 0x18
Function at 0x8528a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xa69498
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00626140
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x7f8
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x50], ecx
mov ecx, dword [esi + 0x2b8]
mov dword [eax], ecx
mov edx, dword [esi + 0x2bc]
mov eax, dword [esp + 0x34]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
add eax, 8
lea edi, [eax + ecx]
add eax, 2
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x2c]
xor edx, edx
lea ebp, [esi + 0x3a8]
push eax
mov ecx, ebp
mov word [edi], dx
call fcn.008527c0
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
call fcn.008527e0
mov ebp, dword [esp + 0x30]
mov byte [esp + 0x50], 2
cmp ebp, dword [esp + 0x28]
je 0x8529d1
lea ebx, [esi + 0x2e0]
lea esi, [ebp + 8]
push esi
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
call fcn.00852800
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.008527a0
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 4]
mov edx, dword [0xda56e4]
setne al
mov dword [esp + 0x14], vtable.phListSpace::_phListIterator_struct_stWHPerson__unsigned_long_long_unsigned___int64___struct_Int64HashGen_.0
mov dword [esp + 0x18], edx
test al, al
je 0x8529b4
mov eax, dword [esi]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x34]
mov dword [ecx + edx], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov dword [eax + ecx + 4], esi
add dword [esp + 0x3c], 8
inc word [edi]
mov ebp, dword [ebp + 0x20]
mov edx, dword [0xda56e4]
mov dword [esp + 0x20], edx
cmp ebp, dword [esp + 0x28]
jne 0x852954
cmp word [edi], 0
mov dword [esp + 0x30], ebp
jne 0x8529fa
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x54], 0xffffffff
call fcn.00626120
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x34]
push ecx
call fcn.00491960
mov edx, dword [0xce1d00]
mov eax, dword [edx + 0x570]
mov byte [eax + 0x830c], 1
mov dword [eax + 0x8370], 0
mov byte [eax + 0x8374], 1
mov eax, dword [esp + 0x38]
push eax
mov dword [esp + 0x58], 0xffffffff
call fcn.00626120
add esp, 8
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x853150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xa69540
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
lea eax, [esp + 0x34]
lea ebx, [edi + 0x3a8]
push eax
mov ecx, ebx
call fcn.008527c0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebx
mov dword [esp + 0x4c], 0
call fcn.008527e0
mov ebp, dword [esp + 0x38]
mov byte [esp + 0x48], 1
cmp ebp, dword [esp + 0x30]
je 0x85324f
add edi, 0x2e0
lea edx, [ebp + 8]
push edx
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call fcn.00852800
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.008527a0
mov esi, dword [esp + 0x28]
cmp esi, dword [eax + 4]
mov edx, dword [0xda56e4]
setne al
mov dword [esp + 0x1c], vtable.phListSpace::_phListIterator_struct_stWHPerson__unsigned_long_long_unsigned___int64___struct_Int64HashGen_.0
mov dword [esp + 0x20], edx
test al, al
je 0x853230
cmp byte [esi + 4], 0
je 0x853230
push esi
mov ecx, edi
call fcn.00850ad0
dec dword [edi + 0xc0]
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x40]
mov dword [eax + 0x40], ecx
mov edx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
mov dword [edx + 0x3c], eax
mov byte [esi + 4], 0
mov ecx, dword [edi + 0x1c]
mov dword [esi], ecx
mov dword [edi + 0x1c], esi
mov ebp, dword [ebp + 0x20]
mov edx, dword [0xda56e4]
mov dword [esp + 0x28], edx
cmp ebp, dword [esp + 0x30]
jne 0x8531c2
mov edi, dword [esp + 0x18]
mov dword [esp + 0x38], ebp
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
lea ecx, [eax*4 + 4]
push ecx
push 0
push edx
call fcn.00a2a210
add esp, 0xc
lea ecx, [ebx + 8]
call fcn.00922e80
lea ecx, [ebx + 0x1c]
call fcn.0066a050
lea ecx, [ebx + 0x58]
lea eax, [ebx + 0x30]
mov dword [ebx + 0x4c], ecx
mov ecx, edi
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x80], 0
call fcn.00852ba0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x88af50
Capabilities:
Get number of processors

Disassembly:
push esi
mov esi, ecx
call fcn.0088aeb0
mov eax, dword [esi + 0x218]
test eax, eax
je 0x88af77
push eax
mov ecx, 0xdaf3e8
call fcn.008e8890
mov dword [esi + 0x218], 0
mov ecx, esi
pop esi
jmp fcn.00899c00

Function at 0x8948b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xa6bce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x40]
lea ebx, [esi + 0x64]
lea eax, [esp + 0x28]
push eax
mov ecx, ebx
mov dword [esp + 0x44], ebx
call fcn.00648210
mov ecx, dword [esi + 0x108]
cmp ecx, dword [eax + 4]
mov ebp, dword [esp + 0x44]
setne al
test al, al
je 0x89496a
mov esi, dword [ecx + 8]
mov dx, word [esi + 0x62]
mov ax, word [esi + 0x60]
mov cx, word [esi + 0x62]
mov di, word [esi + 0x60]
add ax, word [esi + 0x5c]
add cx, word [esi + 0x5e]
mov word [esp + 0x22], dx
movzx edx, word [ebp]
cmp dx, di
jl 0x89496a
movzx edi, word [ebp + 2]
cmp di, word [esp + 0x22]
jl 0x89496a
cmp dx, ax
jge 0x89496a
cmp di, cx
jge 0x89496a
mov eax, dword [esi + 4]
shr eax, 1
test al, 1
jne 0x89496a
mov ecx, dword [esp + 0x14]
push ebp
push esi
call fcn.008948b0
test byte [esi + 0xc], 1
jne 0x894a59
test eax, eax
jne 0x894a43
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.006481f0
lea edx, [esp + 0x18]
push edx
mov ecx, ebx
mov dword [esp + 0x3c], 0
call fcn.00648210
mov edi, dword [esp + 0x24]
cmp edi, dword [eax + 4]
mov ecx, dword [0xd955a4]
setne al
mov dword [esp + 0x18], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x1c], ecx
test al, al
je 0x894a41
mov edi, edi
mov esi, dword [edi + 8]
mov dx, word [esi + 0x62]
mov ax, word [esi + 0x60]
mov cx, word [esi + 0x62]
mov bx, word [esi + 0x60]
add ax, word [esi + 0x5c]
add cx, word [esi + 0x5e]
mov word [esp + 0x2a], dx
movzx edx, word [ebp]
cmp dx, bx
jl 0x894a0c
movzx ebx, word [ebp + 2]
cmp bx, word [esp + 0x2a]
jl 0x894a0c
cmp dx, ax
jge 0x894a0c
cmp bx, cx
jge 0x894a0c
mov eax, dword [esi + 4]
shr eax, 1
test al, 1
jne 0x894a0c
mov ecx, dword [esp + 0x14]
push ebp
push esi
call fcn.008948b0
test byte [esi + 0xc], 1
jne 0x894a59
test eax, eax
jne 0x894a43
mov edi, dword [edi + 0x34]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x28], edi
call fcn.00648210
cmp edi, dword [eax + 4]
mov edx, dword [0xd955a4]
setne al
mov dword [esp + 0x18], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x1c], edx
test al, al
jne 0x8949b0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
test eax, eax
jne 0x894a43
mov eax, esi
jmp 0x894a43
Function at 0x894a70
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xa6bcb8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x28]
call fcn.00894530
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.006481f0
mov edi, dword [eax + 4]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.00648210
cmp edi, dword [eax + 4]
mov edx, dword [0xd955a4]
setne al
mov dword [esp + 0x18], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x1c], edx
test al, al
je 0x894b84
nop
mov esi, dword [edi + 8]
mov ax, word [esi + 0x60]
mov cx, word [esi + 0x62]
mov edx, dword [esi]
mov bx, word [esi + 0x60]
mov bp, word [esi + 0x62]
add bx, word [esi + 0x5c]
add bp, word [esi + 0x5e]
mov word [esp + 0x20], ax
mov eax, dword [edx + 0xc]
mov word [esp + 0x22], cx
mov ecx, esi
call eax
cmp eax, 1
jne 0x894b4f
mov ecx, dword [esi + 4]
shr ecx, 1
test al, cl
jne 0x894b4f
mov edx, dword [esp + 0x44]
movzx ecx, word [edx]
cmp cx, word [esp + 0x20]
jl 0x894b4f
movzx eax, word [edx + 2]
cmp ax, word [esp + 0x22]
jl 0x894b4f
cmp cx, bx
jge 0x894b4f
cmp ax, bp
jl 0x894b9c
mov edi, dword [edi + 0x34]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x30], edi
call fcn.00648210
cmp edi, dword [eax + 4]
mov ecx, dword [0xd955a4]
setne al
mov dword [esp + 0x18], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x1c], ecx
test al, al
jne 0x894af0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
mov ecx, dword [esp + 0x14]
push edx
lea edx, [esi + 0x64]
push edx
call fcn.00894a70
mov ecx, dword [esi + 0xc]
shr ecx, 3
test cl, 1
jne 0x894bca
mov ecx, dword [esi + 4]
mov edx, ecx
shr edx, 5
test dl, 1
jne 0x894bca
shr ecx, 4
test cl, 1
je 0x894b86
test eax, eax
jne 0x894b86
mov eax, esi
jmp 0x894b86
Function at 0x894be0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xa6bce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x40]
lea ebx, [esi + 0x64]
lea eax, [esp + 0x28]
push eax
mov ecx, ebx
mov dword [esp + 0x44], ebx
call fcn.00648210
mov ecx, dword [esi + 0x108]
cmp ecx, dword [eax + 4]
mov ebp, dword [esp + 0x44]
setne al
test al, al
je 0x894c9e
mov esi, dword [ecx + 8]
mov dx, word [esi + 0x62]
mov ax, word [esi + 0x60]
mov cx, word [esi + 0x62]
mov di, word [esi + 0x60]
add ax, word [esi + 0x5c]
add cx, word [esi + 0x5e]
mov word [esp + 0x22], dx
movzx edx, word [ebp]
cmp dx, di
jl 0x894c9e
movzx edi, word [ebp + 2]
cmp di, word [esp + 0x22]
jl 0x894c9e
cmp dx, ax
jge 0x894c9e
cmp di, cx
jge 0x894c9e
mov eax, dword [esi + 4]
shr eax, 1
test al, 1
jne 0x894c9e
mov ecx, dword [esp + 0x14]
push ebp
push esi
call fcn.00894be0
mov ecx, dword [esi + 0xc]
shr ecx, 1
test cl, 1
jne 0x894d8f
test eax, eax
jne 0x894d79
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
call fcn.006481f0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x3c], 0
call fcn.00648210
mov edi, dword [esp + 0x24]
cmp edi, dword [eax + 4]
mov ecx, dword [0xd955a4]
setne al
mov dword [esp + 0x18], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x1c], ecx
test al, al
je 0x894d77
mov esi, dword [edi + 8]
mov dx, word [esi + 0x62]
mov ax, word [esi + 0x60]
mov cx, word [esi + 0x62]
mov bx, word [esi + 0x60]
add ax, word [esi + 0x5c]
add cx, word [esi + 0x5e]
mov word [esp + 0x2a], dx
movzx edx, word [ebp]
cmp dx, bx
jl 0x894d42
movzx ebx, word [ebp + 2]
cmp bx, word [esp + 0x2a]
jl 0x894d42
cmp dx, ax
jge 0x894d42
cmp bx, cx
jge 0x894d42
mov eax, dword [esi + 4]
shr eax, 1
test al, 1
jne 0x894d42
mov ecx, dword [esp + 0x14]
push ebp
push esi
call fcn.00894be0
mov ecx, dword [esi + 0xc]
shr ecx, 1
test cl, 1
jne 0x894d8f
test eax, eax
jne 0x894d79
mov edi, dword [edi + 0x34]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x28], edi
call fcn.00648210
cmp edi, dword [eax + 4]
mov ecx, dword [0xd955a4]
setne al
mov dword [esp + 0x18], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x1c], ecx
test al, al
jne 0x894ce2
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
test eax, eax
jne 0x894d79
mov eax, esi
jmp 0x894d79
Function at 0x8954e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xa6bdb0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [ecx + 0x108]
xor ebx, ebx
lea edi, [ecx + 0x64]
mov eax, vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov ebp, esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x38], 1
lea ebx, [ebx]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.00648210
or ebx, 1
cmp esi, dword [eax + 4]
je 0x895566
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 4]
shr edx, 9
test dl, 1
je 0x895566
mov al, 1
jmp 0x895568
xor al, al
test bl, 1
je 0x895582
mov ecx, dword [0xd955a4]
and ebx, 0xfffffffe
mov dword [esp + 0x18], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x1c], ecx
test al, al
je 0x89559a
mov ebp, esi
mov esi, dword [esi + 8]
mov dword [esp + 0x14], edi
lea edi, [esi + 0x64]
mov esi, dword [esi + 0x108]
jmp 0x895540
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], ebp
call fcn.00648210
cmp ebp, dword [eax + 4]
je 0x8955ef
mov eax, dword [esp + 0x44]
cmp eax, 3
jne 0x8955d4
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [esp + 0x40]
mov eax, dword [eax + 0x8c]
push edx
call eax
mov al, 1
jmp 0x8955f1
cmp eax, 2
jne 0x8955ef
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [esp + 0x40]
mov edx, dword [edx + 0x90]
push eax
call edx
mov al, 1
jmp 0x8955f1
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8

Function at 0x897110
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xa6f5f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x20
push 0x40
call fcn.0078f9b0
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [ecx + 4], 0x20
mov dword [ecx], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], ebx
call fcn.00893870
mov byte [esi + 0x38], bl
lea eax, [esi + 0x2c]
lea ecx, [esi + 0x64]
mov edx, vtable.phListSpace::_phListIteratorBase_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [eax + 0x2c], edx
mov byte [eax + 4], bl
mov dword [eax + 0x30], eax
mov dword [eax + 0x34], eax
mov byte [ecx + 0xc], bl
mov dword [ecx + 0x2c], edx
mov byte [ecx + 4], bl
mov dword [ecx + 0x30], ecx
mov dword [ecx + 0x34], ecx
mov dword [esi + 0x98], eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x9c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x898e30
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xa6cc08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
cmp byte [esp + 0x30], 0
je 0x898e66
mov dword [ecx + 0xc], 0
jmp 0x898e6d
mov dword [ecx + 0xc], 0xf
mov ebx, dword [esp + 0x34]
test bl, bl
je 0x898efd
lea edi, [ecx + 0x64]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.006481f0
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.00648210
mov esi, dword [esp + 0x1c]
cmp esi, dword [eax + 4]
mov edx, dword [0xd955a4]
setne al
mov dword [esp + 0x10], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x14], edx
test al, al
je 0x898efd
lea esp, [esp]
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 8]
push ebx
push eax
call fcn.00898e30
mov esi, dword [esi + 0x34]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x20], esi
call fcn.00648210
cmp esi, dword [eax + 4]
mov edx, dword [0xd955a4]
setne al
mov dword [esp + 0x10], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x14], edx
test al, al
jne 0x898ec0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8

Function at 0x899000
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xa6cc08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x30]
lea edi, [ecx + 0x64]
lea eax, [esp + 0x18]
mov dword [ecx + 0x118], ebx
push eax
mov ecx, edi
call fcn.006481f0
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.00648210
mov esi, dword [esp + 0x1c]
cmp esi, dword [eax + 4]
mov edx, dword [0xd955a4]
setne al
mov dword [esp + 0x10], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x14], edx
test al, al
je 0x8990ab
mov ecx, dword [esi + 8]
push ebx
call fcn.00899000
mov esi, dword [esi + 0x34]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x20], esi
call fcn.00648210
cmp esi, dword [eax + 4]
mov ecx, dword [0xd955a4]
setne al
mov dword [esp + 0x10], vtable.phListSpace::_phListIterator_class_uWnd___struct_String_32___struct_StrHashGen_.0
mov dword [esp + 0x14], ecx
test al, al
jne 0x899073
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4