joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4869b3
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
mov dword [esp + 8], esi
cmp dword [esi], 0
je 0x4869cb
mov eax, 0x80004005
pop esi
add esp, 0x28
ret 0x18
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4869d9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x486af7
mov ecx, dword [esp + 0x34]
push ebx
push ebp
lea eax, [esp + 0x1c]
push edi
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
push 0x28
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_operatornew
mov ebx, eax
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [ebx], 0x28
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov word [ebx + 0xc], 1
mov dx, word [esp + 0x36]
mov dword [ebx + 0x10], eax
mov word [ebx + 0xe], dx
mov esi, dword [esp + 0x36]
and esi, 0xffff
add esp, 4
imul esi, dword [esp + 0x10]
add esi, 0x1f
push eax
sar esi, 3
and esi, 0xfffffffc
imul esi, ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
push esi
mov dword [esp + 0x1c], edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
push 0
push ebx
push eax
mov eax, dword [esp + 0x4c]
push ebp
push 0
push eax
push edi
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
lea ecx, [esp + 0x54]
push 0
push ecx
push 0
push ebx
push edi
mov dword [esp + 0x68], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov eax, dword [esp + 0x50]
test eax, eax
je 0x486ac2
mov ecx, esi
mov esi, dword [esp + 0x10]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x486ad3
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
test ebx, ebx
je 0x486ae0
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x14]
pop edi
mov esi, eax
mov dword [eax + 0x24], ebp
pop ebp
pop ebx
jmp 0x486afe
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x24], ecx
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x18], edx
mov edx, dword [esi + 0xc]
mov dword [esi + 0x20], eax
push edx
mov dword [esi + 0x1c], ecx
mov dword [esi], 1
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [esp + 0x10]
push ecx
push 4
push esi
push 0x486b70
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edx, dword [esp + 0x58]
add esp, 0x18
mov dword [esi + 8], eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
add esp, 0x28
ret 0x18
Function at 0x489db0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
mov eax, dword [edi + 4]
cmp eax, 0x100
je 0x489dcc
cmp eax, 0x104
jne 0x489de1
cmp dword [edi + 8], 0x79
jne 0x489de1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 0xfe
test ax, ax
jne 0x489df7
cmp dword [edi + 4], 0x7b
je 0x489df7
push edi
mov ecx, esi
call sub.MFC42.DLL_CControlBar::PreTranslateMessage
pop edi
pop esi
add esp, 0x10
ret 4
mov ecx, dword [esi + 0x20]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea edx, [esp + 8]
mov ecx, esi
push edx
call sub.MFC42.DLL_CWnd::ClientToScreen
mov ecx, esi
call sub.MFC42.DLL_CWnd::Default
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 4
Function at 0x48b6e0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov eax, dword [ebx + 0x20]
push esi
push 0x419
push eax
call edi
cmp eax, 0xffffffff
je 0x48b714
mov ecx, dword [ebx + 0x20]
push 0
push eax
push 0x416
push ecx
call edi
mov ecx, ebx
xor edi, edi
call fcn.004889b0
test eax, eax
jle 0x48b73e
xor ebp, ebp
mov edx, dword [ebx + 0xa4]
cmp dword [edx + ebp + 4], esi
je 0x48b74a
mov ecx, ebx
inc edi
add ebp, 0x68
call fcn.004889b0
cmp edi, eax
jl 0x48b723
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
mov ecx, ebx
mov dword [esp + 0x10], edi
call fcn.004889b0
dec eax
cmp edi, eax
jge 0x48b78f
lea eax, [edi + edi*2]
lea ebp, [edi + eax*4]
shl ebp, 3
mov eax, dword [ebx + 0xa4]
mov ecx, 0x1a
lea esi, [eax + ebp + 0x68]
lea edi, [eax + ebp]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
mov ecx, ebx
inc esi
add ebp, 0x68
mov dword [esp + 0x10], esi
call fcn.004889b0
dec eax
cmp esi, eax
jl 0x48b763
mov ecx, dword [ebx + 0xa0]
xor edi, edi
dec ecx
mov dword [ebx + 0xa0], ecx
mov edx, dword [ebx + 0xec]
mov eax, dword [ebx + 0xe8]
mov esi, edx
mov dword [esp + 0x18], esi
lea ebp, [esi + 1]
cmp ebp, edi
jne 0x48b7db
cmp eax, edi
je 0x48b7ca
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebx + 0xe8], edi
mov dword [ebx + 0xf0], edi
mov dword [ebx + 0xec], edi
jmp 0x48b8ed
cmp eax, edi
jne 0x48b81c
lea edi, [ebp*4]
push edi
call sub.MFC42.DLL_operatornew
mov edx, eax
mov ecx, edi
mov dword [ebx + 0xe8], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov dword [ebx + 0xf0], ebp
mov dword [ebx + 0xec], ebp
jmp 0x48b8ed
mov ecx, dword [ebx + 0xf0]
cmp ebp, ecx
jg 0x48b840
cmp ebp, edx
jle 0x48b835
mov ecx, ebp
lea edi, [eax + edx*4]
sub ecx, edx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebx + 0xec], ebp
jmp 0x48b8ed
mov eax, dword [ebx + 0xf4]
cmp eax, edi
jne 0x48b86d
mov eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, 4
jge 0x48b861
mov eax, 4
jmp 0x48b86d
cmp eax, 0x400
jle 0x48b86d
mov eax, 0x400
add eax, ecx
cmp ebp, eax
mov dword [esp + 0x10], eax
jl 0x48b87b
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
lea ecx, [eax*4]
push ecx
call sub.MFC42.DLL_operatornew
mov ecx, dword [ebx + 0xec]
mov esi, dword [ebx + 0xe8]
shl ecx, 2
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x18], eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0xec]
mov ecx, ebp
sub ecx, edx
lea edi, [eax + edx*4]
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0xe8]
push eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
add esp, 8
mov dword [ebx + 0xe8], ecx
mov dword [ebx + 0xec], ebp
mov dword [ebx + 0xf0], edx
mov eax, dword [ebx + 0xe8]
mov ecx, dword [esp + 0x20]
pop edi
mov dword [eax + esi*4], ecx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
Function at 0x48c260
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52ae8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004922f0
xor edi, edi
push 0x80
mov dword [esp + 0x1c], edi
mov dword [esi + 0x20], vtable.Table_struct_CCoolMenuManager::CMyItemData_.0
call sub.MFC42.DLL_operatornew
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x1f
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x40
mov ebx, 1
push 0x80
mov byte [esp + 0x20], bl
mov dword [esi + 0x40], vtable.Table_struct_CCoolMenuManager::ToolbarParams_.0
call sub.MFC42.DLL_operatornew
add esp, 8
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], 0x1f
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], 0x40
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CImageList::CImageList
push 0xa
lea ecx, [esi + 0x64]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CMapWordToPtr::CMapWordToPtr
push 0xa
lea ecx, [esi + 0x80]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CMapWordToPtr::CMapWordToPtr
push 0xa
lea ecx, [esi + 0xa4]
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CPtrList::CPtrList
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd0], vtable.CFont.0
xor eax, eax
xor ecx, ecx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xc0], eax
mov byte [esp + 0x18], 7
mov dword [esi], vtable.CCoolMenuManager.0
mov dword [esi + 0xcc], ecx
mov dword [esi + 0xc4], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0048e600
mov dword [esi + 0x30], edi
mov dword [esi + 0x50], ebx
push 0x568ac0
mov dword [0x568ac0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x48e4f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push esi
push edi
mov edi, dword [esp + 0x4c]
mov esi, ecx
push 9
mov ecx, edi
call sub.MFC42.DLL_CString::Find_2
test eax, eax
jle 0x48e512
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret 8
mov ecx, dword [esp + 0x50]
push ebx
lea eax, [esp + 0x50]
push ebp
push eax
push ecx
lea ecx, [esi + 0x80]
xor ebx, ebx
call sub.MFC42.DLL_CMapWordToPtr::Lookup
mov esi, eax
mov eax, dword [esp + 0x54]
neg esi
sbb esi, esi
and esi, eax
je 0x48e5ef
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ebx, ebx
mov eax, 0x5592d0
jne 0x48e551
mov eax, 0x559830
push eax
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
test byte [esi], 0x10
je 0x48e56a
push str.Alt
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
test byte [esi], 8
je 0x48e57b
push str.Ctrl
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
test byte [esi], 4
je 0x48e58c
push str.Shift
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
test byte [esi], 1
je 0x48e5bb
xor edx, edx
push 0
mov dx, word [esi + 2]
push edx
call ebp
lea ecx, [esp + 0x10]
push 0x40
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea edx, [esp + 0x10]
mov ecx, edi
push edx
call sub.MFC42.DLL_CString::operator_2
jmp 0x48e5c6
mov al, byte [esi + 2]
mov ecx, edi
push eax
call fcn.004fe958
mov ax, word [esi + 4]
mov ebx, 1
test ax, ax
je 0x48e5ef
and eax, 0xffff
lea ecx, [eax*4]
sub ecx, eax
neg ecx
lea esi, [esi + ecx*2]
test esi, esi
jne 0x48e543
mov eax, ebx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x40
ret 8

Function at 0x48fa40
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52b1d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x1e14
mov dword [esp + 0x18], esi
call sub.MFC42.DLL_CDialog::CDialog_1
lea edi, [esi + 0x60]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.004fdecc
lea ebx, [esi + 0x64]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call fcn.004fdecc
lea ebp, [esi + 0x68]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call fcn.004fdecc
lea ecx, [esi + 0x6c]
mov byte [esp + 0x1c], 3
call fcn.004fdecc
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x1c], 4
push ecx
mov ecx, edi
mov dword [esi], vtable.CNoShowMessageBox.0
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 0x2c]
mov ecx, ebx
push edx
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x30]
mov ecx, ebp
push eax
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esi + 0x6c]
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x70], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x4bd400
Capabilities:
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x450
push esi
mov esi, ecx
lea ecx, [esp + 0x24c]
push edi
mov eax, dword [esi + 0xb0]
push ecx
push 0x104
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x568b80
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str..APL
lea edx, [esp + 0x358]
push 0x568b80
push edx
call fcn.00472190
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x354]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4bd4c2
push ebx
mov ebx, dword [esp + 0x460]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x40]
lea eax, [esp + 0x154]
push edx
push 0x568b80
push eax
call fcn.00472190
add esp, 0xc
lea ecx, [esp + 0x154]
push ecx
push ebx
mov ecx, esi
call fcn.004bd4f0
lea edx, [esp + 0x14]
push edx
push edi
call ebp
test eax, eax
jne 0x4bd475
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebp
pop ebx
mov edi, dword [esi + 0xb0]
mov ecx, esi
call fcn.004bd2a0
mov ecx, dword [esp + 8]
mov eax, edi
pop edi
sub eax, ecx
pop esi
add esp, 0x450
ret 4
Function at 0x4c2200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
push edi
test bl, 1
mov esi, ecx
je 0x4c223d
mov eax, dword [esi + 8]
xor edi, edi
test eax, eax
jle 0x4c223d
cmp edi, eax
jge 0x4c2227
test edi, edi
jl 0x4c2227
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*4]
jmp 0x4c2229
xor ecx, ecx
mov eax, dword [esi + 0xc8]
mov edx, dword [ecx]
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 8]
inc edi
cmp edi, eax
jl 0x4c221b
test bl, 0x10
je 0x4c2271
mov eax, dword [esi + 0x24]
xor edi, edi
test eax, eax
jle 0x4c2271
cmp edi, eax
jge 0x4c225b
test edi, edi
jl 0x4c225b
mov ecx, dword [esi + 0x20]
mov ecx, dword [ecx + edi*4]
jmp 0x4c225d
xor ecx, ecx
mov eax, dword [esi + 0xcc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 0x24]
inc edi
cmp edi, eax
jl 0x4c224f
test bl, 2
je 0x4c22a5
mov eax, dword [esi + 0x40]
xor edi, edi
test eax, eax
jle 0x4c22a5
cmp edi, eax
jge 0x4c228f
test edi, edi
jl 0x4c228f
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + edi*4]
jmp 0x4c2291
xor ecx, ecx
mov eax, dword [esi + 0xd0]
mov edx, dword [ecx]
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 0x40]
inc edi
cmp edi, eax
jl 0x4c2283
test bl, 4
je 0x4c22d9
mov eax, dword [esi + 0x5c]
xor edi, edi
test eax, eax
jle 0x4c22d9
cmp edi, eax
jge 0x4c22c3
test edi, edi
jl 0x4c22c3
mov ecx, dword [esi + 0x58]
mov ecx, dword [ecx + edi*4]
jmp 0x4c22c5
xor ecx, ecx
mov eax, dword [esi + 0xd4]
mov edx, dword [ecx]
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 0x5c]
inc edi
cmp edi, eax
jl 0x4c22b7
test bl, 8
je 0x4c230d
mov eax, dword [esi + 0x78]
xor edi, edi
test eax, eax
jle 0x4c230d
cmp edi, eax
jge 0x4c22f7
test edi, edi
jl 0x4c22f7
mov ecx, dword [esi + 0x74]
mov ecx, dword [ecx + edi*4]
jmp 0x4c22f9
xor ecx, ecx
mov eax, dword [esi + 0xd8]
mov edx, dword [ecx]
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 0x78]
inc edi
cmp edi, eax
jl 0x4c22eb
pop edi
pop esi
pop ebx
ret 4
Function at 0x4c3c30
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 0x108]
push str.IEP_Init
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IEP_Free
push ecx
mov dword [esi + 0x144], eax
call edi
mov edx, dword [esi + 0x108]
push str.IEP_GetPlugInInfo
push edx
mov dword [esi + 0x148], eax
call edi
mov dword [esi + 0x14c], eax
mov eax, dword [esi + 0x108]
push str.IEP_ShowPlugInDialog
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IEP_GetError
push ecx
mov dword [esi + 0x150], eax
call edi
mov edx, dword [esi + 0x108]
push str.IEP_GetDefaultEncodeParams
push edx
mov dword [esi + 0x154], eax
call edi
mov dword [esi + 0x158], eax
mov eax, dword [esi + 0x108]
push str.IEP_ShowEncodeParamsDialog
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IEP_GetValidPixelFormats
push ecx
mov dword [esi + 0x15c], eax
call edi
mov edx, dword [esi + 0x108]
push str.IEP_ImageEncode
push edx
mov dword [esi + 0x160], eax
call edi
mov dword [esi + 0x164], eax
mov eax, dword [esi + 0x108]
push str.IEP_ImageEncodeStart
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IEP_ImageEncodePage
push ecx
mov dword [esi + 0x168], eax
call edi
mov edx, dword [esi + 0x108]
push str.IEP_ImageEncodeFinish
push edx
mov dword [esi + 0x16c], eax
call edi
mov dword [esi + 0x170], eax
mov eax, dword [esi + 0x108]
push str.IEP_SetAudio
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IEP_SetMetadata
push ecx
mov dword [esi + 0x174], eax
call edi
mov edx, dword [esi + 0x108]
push str.IEP_Help
push edx
mov dword [esi + 0x178], eax
call edi
mov dword [esi + 0x17c], eax
mov eax, dword [esi + 0x108]
push str.IEP_ErrorHandler
push eax
call edi
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x180], eax
call dword [edx + 0xc]
pop edi
pop esi
ret
Function at 0x4c44a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52c408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004f1260
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.004bc610
mov ecx, dword [esi + 0x114]
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x110]
mov dword [esp + 0x1c], ecx
mov cx, word [esi + 0x10c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov ax, word [esi + 0x10e]
lea edx, [esp + 0x14]
mov word [esp + 0x14], cx
push 0x12
push edx
lea ecx, [esp + 0x10]
mov word [esp + 0x1e], ax
mov word [esp + 0x2c], 0x64
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
test eax, eax
je 0x4c457a
test byte [esi + 0x10e], 1
je 0x4c457a
push 0x38
push eax
lea ecx, [esp + 0x10]
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
xor edi, edi
mov ecx, dword [eax + 0x34]
test ecx, ecx
jle 0x4c457a
push ebx
xor ebx, ebx
mov eax, dword [eax + 0x38]
push 0x44
add eax, ebx
lea ecx, [esp + 0x10]
push eax
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
inc edi
add ebx, 0x44
cmp edi, dword [eax + 0x34]
jl 0x4c4559
pop ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
sub ecx, eax
add esi, 4
push ecx
mov ecx, dword [esp + 0x3c]
push eax
push esi
call fcn.00478130
xor edx, edx
lea ecx, [esp + 8]
test eax, eax
sete dl
mov esi, edx
mov dword [esp + 0x30], 0xffffffff
call fcn.004f1290
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4c6dc0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 0x108]
push str.PXP_Init
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.PXP_Free
push ecx
mov dword [esi + 0x144], eax
call edi
mov edx, dword [esi + 0x108]
push str.PXP_GetPlugInInfo
push edx
mov dword [esi + 0x148], eax
call edi
mov dword [esi + 0x14c], eax
mov eax, dword [esi + 0x108]
push str.PXP_StartPane
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.PXP_PreTranslateMessage
push ecx
mov dword [esi + 0x150], eax
call edi
mov edx, dword [esi + 0x108]
push str.PXP_ShowPlugInDialog
push edx
mov dword [esi + 0x154], eax
call edi
mov dword [esi + 0x158], eax
mov eax, dword [esi + 0x108]
push str.PXP_Help
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.PXP_ErrorHandler
push ecx
mov dword [esi + 0x15c], eax
call edi
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x160], eax
call dword [edx + 0xc]
pop edi
pop esi
ret
Function at 0x4c7430
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52c6b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004f1260
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.004bc610
mov ecx, dword [esi + 0x114]
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x110]
mov dword [esp + 0x1c], ecx
mov cx, word [esi + 0x10c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov ax, word [esi + 0x10e]
lea edx, [esp + 0x14]
mov word [esp + 0x14], cx
push 0x12
push edx
lea ecx, [esp + 0x10]
mov word [esp + 0x1e], ax
mov word [esp + 0x2c], 0x64
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
test eax, eax
je 0x4c7506
test byte [esi + 0x10e], 1
je 0x4c7506
push 0x3c
push eax
lea ecx, [esp + 0x10]
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
xor edi, edi
mov ecx, dword [eax + 0x38]
test ecx, ecx
jle 0x4c7506
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + edi*4]
mov cx, word [eax]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
inc edi
cmp edi, dword [eax + 0x38]
jl 0x4c74e6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x38]
sub edx, eax
push edx
add esi, 4
push eax
push esi
call fcn.00478130
xor ecx, ecx
mov dword [esp + 0x30], 0xffffffff
test eax, eax
sete cl
mov esi, ecx
lea ecx, [esp + 8]
call fcn.004f1290
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4c80e0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 0x108]
push str.IDP_Init
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IDP_Free
push ecx
mov dword [esi + 0x144], eax
call edi
mov edx, dword [esi + 0x108]
push str.IDP_GetPlugInInfo
push edx
mov dword [esi + 0x148], eax
call edi
mov dword [esi + 0x14c], eax
mov eax, dword [esi + 0x108]
push str.IDP_ShowPlugInDialog
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IDP_GetError
push ecx
mov dword [esi + 0x150], eax
call edi
mov edx, dword [esi + 0x108]
push str.IDP_OpenImage
push edx
mov dword [esi + 0x154], eax
call edi
mov dword [esi + 0x158], eax
mov eax, dword [esi + 0x108]
push str.IDP_CloseImage
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IDP_GetImageInfo
push ecx
mov dword [esi + 0x15c], eax
call edi
mov edx, dword [esi + 0x108]
push str.IDP_GetPageInfo
push edx
mov dword [esi + 0x160], eax
call edi
mov dword [esi + 0x164], eax
mov eax, dword [esi + 0x108]
push str.IDP_PageDecode
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IDP_PageDecodeStart
push ecx
mov dword [esi + 0x168], eax
call edi
mov edx, dword [esi + 0x108]
push str.IDP_PageDecodeStep
push edx
mov dword [esi + 0x16c], eax
call edi
mov dword [esi + 0x170], eax
mov eax, dword [esi + 0x108]
push str.IDP_PageDecodeStop
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IDP_GetMetadata
push ecx
mov dword [esi + 0x174], eax
call edi
mov edx, dword [esi + 0x108]
push str.IDP_FreeMetadata
push edx
mov dword [esi + 0x178], eax
call edi
mov dword [esi + 0x17c], eax
mov eax, dword [esi + 0x108]
push str.IDP_GetEmbeddeddata
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IDP_FreeEmbeddeddata
push ecx
mov dword [esi + 0x180], eax
call edi
mov edx, dword [esi + 0x108]
push str.IDP_GetAudio
push edx
mov dword [esi + 0x184], eax
call edi
mov dword [esi + 0x188], eax
mov eax, dword [esi + 0x108]
push str.IDP_Help
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.IDP_CreateView
push ecx
mov dword [esi + 0x18c], eax
call edi
mov edx, dword [esi + 0x108]
push str.IDP_PreTranslateMessage
push edx
mov dword [esi + 0x190], eax
call edi
mov dword [esi + 0x194], eax
mov eax, dword [esi + 0x108]
push str.IDP_ErrorHandler
push eax
call edi
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x198], eax
call dword [edx + 0xc]
pop edi
pop esi
ret