joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4195d0
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xb0]
mov eax, dword [ecx]
call dword [eax + 0x138]
mov ecx, dword [esi + 0x14]
mov bl, 1
mov edi, dword [eax + 0x18]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x28]
call eax
test al, al
je 0x419655
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x28]
call eax
test al, al
je 0x419636
mov eax, dword [0x5f34e0]
cmp eax, 0xffffffff
jne 0x41962f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
call fcn.0049cb40
mov dword [0x5f34e0], eax
cmp eax, 0x1e00000
jne 0x419655
test edi, edi
je 0x419655
cmp edi, 0x80
je 0x419655
push dword [esi + 0xb4]
mov ecx, esi
call fcn.004191d0
pop edi
pop esi
xor al, al
pop ebx
ret
push edi
mov ecx, esi
call fcn.004191d0
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x420020
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e632
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::wav::Wave.0
mov dword [edi + 4], vtable.s::sound::wav::Wave.1.0
call fcn.00422d10
mov dword [ebp - 4], 0
lea ecx, [edi + 0x5c]
mov dword [edi + 0x5c], vtable.s::sound::Effect.0
mov dword [edi + 0x60], vtable.s::sound::Effect.1.0
call fcn.00422a10
lea ecx, [edi + 0x64]
call fcn.00408950
lea ecx, [edi + 0x30]
mov dword [edi + 0x60], vtable.s::thread::IPoolable.0
mov dword [edi + 0x5c], vtable.s::base::IComparable.0
call fcn.004210d0
mov dword [ebp - 4], 1
lea esi, [edi + 0xc]
mov edx, dword [esi]
mov dword [edi + 8], vtable.s::thread::ObjLocker.0
test edx, edx
je 0x4200dd
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4200bd
push edx
call eax
add esp, 4
jmp 0x4200d7
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x4200cc
mov eax, dword [ecx]
push esi
call dword [eax + 4]
jmp 0x4200d7
push 0
push edx
call fcn.0051a64c
add esp, 8
mov dword [esi], 0
mov dword [edi + 8], vtable.s::base::IComparable.0
mov dword [ebp - 4], 2
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::IEncodedAudio.0
mov dword [edi + 4], vtable.s::sound::IEncodedAudio.1.0
call fcn.00402390
mov dword [edi + 4], vtable.s::thread::IPoolable.0
mov dword [edi], vtable.s::base::IComparable.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422e30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eb3c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi + 4], vtable.s::thread::IPoolable.0
mov byte [ebp - 4], 1
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::IEncodedAudio.0
mov dword [edi + 4], vtable.s::sound::IEncodedAudio.1.0
call fcn.00402390
mov dword [ebp - 4], 2
lea eax, [edi + 0x18]
mov dword [edi], vtable.s::sound::wav::Wave.0
mov dword [edi + 4], vtable.s::sound::wav::Wave.1.0
push eax
mov dword [edi + 8], vtable.s::thread::ObjLocker.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [edi + 0x30]
push 0
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayU08.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayU08.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayU08.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayU08.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayU08.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayU08.5.0
lea ecx, [edi + 0x5c]
mov byte [ebp - 4], 4
call fcn.00421420
mov byte [ebp - 4], 5
lea ecx, [edi + 4]
mov eax, dword [edi + 4]
mov dword [edi + 0x114], 0
mov dword [edi + 0x118], 0
call dword [eax + 8]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ecd9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], vtable.s::base::IObject.0
mov dword [esi + 8], vtable.s::thread::IPoolable.0
lea ecx, [esi + 0x30]
mov dword [esi], vtable.s::gui::boxes::FolderSelect.0
push 2
mov dword [esi + 4], vtable.s::gui::boxes::FolderSelect.1.0
mov dword [esi + 8], vtable.s::gui::boxes::FolderSelect.2.0
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayP.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayP.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayP.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayP.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayP.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayP.5.0
mov dword [ecx + 0x2c], 0
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00423cb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424c20
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
lea edx, [edi + 0x10]
lea esi, [edi + 0x3c]
mov dword [edx], 0
push edx
push 4
push esi
push 0x45b7c0
mov dword [edi + 0xc], 0
lea eax, [edi + 0x14]
movups xmmword [esi], xmm0
push 0
movups xmmword [esi + 0x10], xmm0
push 0
mov byte [edi + 0x59], 1
mov byte [edi + 0x5b], 0
mov dword [esi], eax
mov dword [edi + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xc], eax
test eax, eax
je 0x424c7c
push dword [edi + 0x5c]
mov dword [edi + 0x40], eax
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x74]
pop edi
pop esi
ret

Function at 0x426cb0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
lea ecx, [eax + eax]
test ecx, ecx
je 0x426d13
mov edx, dword [ebp + 8]
test edx, edx
jne 0x426cd5
call fcn.005200e9
mov dword [eax], 0x16
pop ebp
jmp fcn.0052002d
cmp dword [ebp + 0x10], 0
jne 0x426cec
call fcn.005200e9
mov dword [eax], 0x16
pop ebp
jmp fcn.0052002d
mov eax, dword [ebp + 0xc]
add eax, eax
cmp eax, ecx
jae 0x426d06
call fcn.005200e9
mov dword [eax], 0x22
pop ebp
jmp fcn.0052002d
push ecx
push dword [ebp + 0x10]
push edx
call fcn.0051c230
add esp, 0xc
pop ebp
ret

Function at 0x429810
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f279
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi + 4], vtable.s::thread::IPoolable.0
mov dword [edi], vtable.s::map::MapTable.0
lea eax, [edi + 0x18]
mov dword [edi + 4], vtable.s::map::MapTable.1.0
push eax
mov dword [edi + 8], vtable.s::thread::ObjLocker.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [edi + 0x30]
push 2
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayP.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayP.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayP.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayP.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayP.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayP.5.0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 3
lea ecx, [edi + 4]
mov eax, dword [edi + 4]
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
call dword [eax + 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x60], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x64], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x68], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x6c], eax
mov eax, edi
mov byte [edi + 0x70], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x429a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57df16
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [edi + 0x6c]
mov dword [edi], vtable.s::map::MapTable.0
push dword [edi + 0x64]
mov dword [edi + 4], vtable.s::map::MapTable.1.0
call fcn.00463d70
mov eax, dword [edi + 0x30]
lea ecx, [edi + 0x30]
call dword [eax + 0x70]
lea ecx, [edi + 0x30]
call fcn.00408950
mov dword [ebp - 4], 0
lea esi, [edi + 0xc]
mov edx, dword [esi]
mov dword [edi + 8], vtable.s::thread::ObjLocker.0
test edx, edx
je 0x429ad5
mov eax, dword [edi + 0x10]
test eax, eax
je 0x429ab5
push edx
call eax
add esp, 4
jmp 0x429acf
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x429ac4
mov eax, dword [ecx]
push esi
call dword [eax + 4]
jmp 0x429acf
push 0
push edx
call fcn.0051a64c
add esp, 8
mov dword [esi], 0
mov dword [edi + 8], vtable.s::base::IComparable.0
mov dword [edi + 4], vtable.s::thread::IPoolable.0
mov dword [edi], vtable.s::base::IComparable.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x437895
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4378d6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4378d2
nop word [eax + eax]
cmp esi, edx
jae 0x4378d6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4378c0
cmp esi, edx
jb 0x4378db
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x437cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x3c
lea eax, [ebp - 0x3c]
mov esi, ecx
push 0
push eax
call fcn.0051d050
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], str.open
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x5b9058
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4499e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e216
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esi], vtable.s::gui::counter::CounterData.0
mov dword [esi + 4], vtable.s::gui::counter::CounterData.1.0
call fcn.0044a180
lea ecx, [esi + 0x88]
call fcn.00408950
mov dword [ebp - 4], 0
lea edi, [esi + 0x64]
mov edx, dword [edi]
mov dword [esi + 0x60], vtable.s::thread::ObjLocker.0
test edx, edx
je 0x449a6d
mov eax, dword [esi + 0x68]
test eax, eax
je 0x449a4d
push edx
call eax
add esp, 4
jmp 0x449a67
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x449a5c
mov eax, dword [ecx]
push edi
call dword [eax + 4]
jmp 0x449a67
push 0
push edx
call fcn.0051a64c
add esp, 8
mov dword [edi], 0
lea ecx, [esi + 0x30]
mov dword [esi + 0x60], vtable.s::base::IComparable.0
call fcn.00449d20
mov dword [esi + 4], vtable.s::thread::IPoolable.0
mov dword [esi], vtable.s::base::IComparable.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449dc0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5805e7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi + 4], vtable.s::thread::IPoolable.0
lea ecx, [edi + 0x30]
mov dword [edi], vtable.s::gui::counter::CounterData.0
push 3
mov dword [edi + 4], vtable.s::gui::counter::CounterData.1.0
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayS64.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayS64.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayS64.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayS64.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayS64.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayS64.5.0
lea eax, [edi + 0x70]
mov dword [edi + 0x60], vtable.s::thread::ObjLocker.0
push eax
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [edi + 0x88]
push 2
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayP.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayP.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayP.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayP.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayP.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayP.5.0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 4
lea ecx, [edi + 4]
mov eax, dword [edi + 4]
call dword [eax + 8]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d8b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, edx
xor bl, bl
push edi
mov dword [ebp - 4], esi
mov edi, ecx
call fcn.00408f00
push 0xffffffffffffffff
push 0x5c5784
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
call edx
test al, al
je 0x44d919
mov ecx, edi
call fcn.0043bf50
mov esi, eax
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
call edx
test al, al
je 0x44d90d
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x60]
call eax
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
call dword [eax + 4]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add ecx, 4
mov eax, dword [ecx]
call dword [eax + 4]
push 0x3c
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.0051d050
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
test esi, esi
mov dword [ebp - 0x40], 0
mov eax, 0x5b9058
mov dword [ebp - 0x3c], 0
cmovne eax, esi
mov dword [ebp - 0x38], 0
xor ecx, ecx
mov dword [ebp - 0x30], eax
test bl, bl
mov dword [ebp - 0x34], edi
mov eax, 5
mov dword [ebp - 0x2c], 0
cmovne eax, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44da40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
test ecx, ecx
je 0x44db1f
push esi
push edi
xor edi, edi
call fcn.0043bf50
mov esi, eax
mov ecx, esi
mov eax, dword [esi]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x44db0c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x34]
call eax
test al, al
je 0x44db0c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x58]
call eax
test al, al
je 0x44da8c
mov edi, esi
jmp 0x44da98
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x188]
mov edi, eax
test edi, edi
je 0x44db0c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0051d050
mov eax, dword [edi]
add esp, 0xc
mov ecx, edi
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [eax + 0xa4]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x28], 0x5b9058
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
lea ecx, [edi + 4]
cmp edi, esi
cmove esi, eax
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
cmp edi, esi
je 0x44db1d
test esi, esi
je 0x44db1d
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
call dword [eax + 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44dc70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x3c
lea eax, [ebp - 0x3c]
mov esi, ecx
push 0
push eax
call fcn.0051d050
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], str.properties
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x5b9058
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44fba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580a84
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::mp3::win::Mp3.0
mov dword [edi + 4], vtable.s::sound::mp3::win::Mp3.1.0
call fcn.00452440
mov dword [ebp - 4], 0
lea ecx, [edi + 0x134]
mov dword [edi + 0x130], vtable.s::sound::mp3::FrameHeader.0
mov dword [edi + method.s::sound::mp3::FrameHeader.1.virtual_0], vtable.s::sound::mp3::FrameHeader.1.0
call fcn.004522a0
mov dword [edi + method.s::thread::IPoolable.virtual_0], vtable.s::thread::IPoolable.0
mov dword [edi + 0x130], vtable.s::base::IComparable.0
mov dword [ebp - 4], 1
lea ecx, [edi + 0x11c]
mov dword [edi + fcn.00451c40], vtable.s::sound::mp3::Id3Tag.0
mov dword [edi + method.s::sound::mp3::Id3Tag.1.virtual_0], vtable.s::sound::mp3::Id3Tag.1.0
call fcn.00452280
lea ecx, [edi + 0xdc]
mov dword [edi + method.s::thread::IPoolable.virtual_0], vtable.s::thread::IPoolable.0
mov dword [edi + method.s::base::IObject.virtual_0], vtable.s::base::IComparable.0
call fcn.004210d0
lea ecx, [edi + 0xb0]
call fcn.004210d0
lea ecx, [edi + 0x7c]
call fcn.004210d0
mov dword [ebp - 4], 2
lea ecx, [edi + 0x30]
mov dword [edi + 0x30], vtable.s::sound::Effect.0
mov dword [edi + 0x34], vtable.s::sound::Effect.1.0
call fcn.00422a10
lea ecx, [edi + 0x38]
call fcn.00408950
mov dword [edi + 0x34], vtable.s::thread::IPoolable.0
mov dword [edi + 0x30], vtable.s::base::IComparable.0
mov dword [ebp - 4], 3
lea esi, [edi + 0xc]
mov edx, dword [esi]
mov dword [edi + 8], vtable.s::thread::ObjLocker.0
test edx, edx
je 0x44fce7
mov eax, dword [edi + 0x10]
test eax, eax
je 0x44fcc7
push edx
call eax
add esp, 4
jmp 0x44fce1
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x44fcd6
mov eax, dword [ecx]
push esi
call dword [eax + 4]
jmp 0x44fce1
push 0
push edx
call fcn.0051a64c
add esp, 8
mov dword [esi], 0
mov dword [edi + 8], vtable.s::base::IComparable.0
mov dword [ebp - 4], 4
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::mp3::IMp3.0
mov dword [edi + 4], vtable.s::sound::mp3::IMp3.1.0
call fcn.00402390
mov byte [ebp - 4], 5
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::IEncodedAudio.0
mov dword [edi + 4], vtable.s::sound::IEncodedAudio.1.0
call fcn.00402390
mov dword [edi + 4], vtable.s::thread::IPoolable.0
mov dword [edi], vtable.s::base::IComparable.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580c92
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi + 4], vtable.s::thread::IPoolable.0
mov byte [ebp - 4], 1
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::IEncodedAudio.0
mov dword [edi + 4], vtable.s::sound::IEncodedAudio.1.0
call fcn.00402390
mov dword [ebp - 4], 2
lea ecx, [edi + 4]
mov dword [edi], vtable.s::sound::mp3::IMp3.0
mov dword [edi + 4], vtable.s::sound::mp3::IMp3.1.0
call fcn.00402390
mov dword [ebp - 4], 3
lea eax, [edi + 0x18]
mov dword [edi], vtable.s::sound::mp3::win::Mp3.0
mov dword [edi + 4], vtable.s::sound::mp3::win::Mp3.1.0
push eax
mov dword [edi + 8], vtable.s::thread::ObjLocker.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 4
call fcn.00421420
lea ecx, [edi + 0x7c]
push 0
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayU08.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayU08.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayU08.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayU08.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayU08.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayU08.5.0
lea ecx, [edi + 0xb0]
push 0
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayU08.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayU08.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayU08.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayU08.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayU08.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayU08.5.0
lea ecx, [edi + 0xdc]
push 0
call fcn.00408a20
mov dword [ecx], vtable.s::col::_array::ArrayU08.0
mov dword [ecx + 4], vtable.s::col::_array::ArrayU08.1.0
mov dword [ecx + 8], vtable.s::col::_array::ArrayU08.2.0
mov dword [ecx + 0xc], vtable.s::col::_array::ArrayU08.3.0
mov dword [ecx + 0x10], vtable.s::col::_array::ArrayU08.4.0
mov dword [ecx + 0x14], vtable.s::col::_array::ArrayU08.5.0
lea eax, [edi + 0x118]
mov dword [ebp - 0x14], eax
lea ecx, [eax + 4]
mov dword [ecx], vtable.s::thread::IPoolable.0
mov byte [ebp - 4], 0xa
mov dword [eax], vtable.s::sound::mp3::Id3Tag.0
mov dword [ecx], vtable.s::sound::mp3::Id3Tag.1.0
call fcn.00452280
lea eax, [edi + 0x130]
mov dword [ebp - 0x14], eax
lea ecx, [eax + 4]
mov dword [ecx], vtable.s::thread::IPoolable.0
mov byte [ebp - 4], 0xd
mov dword [eax], vtable.s::sound::mp3::FrameHeader.0
mov dword [ecx], vtable.s::sound::mp3::FrameHeader.1.0
call fcn.004522a0
mov byte [ebp - 4], 0xe
lea ecx, [edi + 4]
mov eax, dword [edi + 4]
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0x200], 0
mov dword [edi + 0x204], 0
call dword [eax + 8]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret