joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59cb3c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
push 0x14
mov dword [esp + 0x30], 3
call fcn.0055d3fe
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
test esi, esi
mov byte [esp + 0x2c], 4
je 0x4b13a8
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004971d0
mov ecx, esi
call fcn.004aec00
jmp 0x4b13aa
xor eax, eax
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
mov byte [esp + 0x30], 3
call fcn.004b1250
mov edx, dword [esi]
sub esp, 8
mov ecx, esp
mov dword [ecx], edx
mov eax, dword [esi + 4]
test eax, eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], esp
mov dword [ecx + 4], eax
je 0x4b13de
add dword [eax + 4], 1
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x40], 5
call fcn.004971d0
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x44], 6
call fcn.004971d0
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x48], 7
call fcn.004971d0
push edi
mov byte [esp + 0x48], 5
call fcn.004aece0
add esp, 0x10
mov byte [esp + 0x38], 8
call fcn.004f5b90
mov ecx, eax
mov byte [esp + 0x38], 3
call fcn.004f6ef0
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 2
call fcn.00497320
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2c], 1
call fcn.00497320
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c], 0
call fcn.00497320
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x4b54f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x59cfc4
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00496d90
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x44]
mov byte [esp + 0x24], 1
call fcn.00496d90
fldz
fst dword [esi + 0x4c]
lea ecx, [esi + 0x64]
fst dword [esi + 0x50]
mov byte [esp + 0x24], 2
fst dword [esi + 0x54]
fstp dword [esi + 0x58]
call fcn.00496d90
push 0x3b4
mov byte [esp + 0x28], 3
call fcn.0055d3fe
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x24], 4
je 0x4b5591
mov ecx, eax
call fcn.004b20f0
jmp 0x4b5593
xor eax, eax
fldz
push ecx
fst dword [esi + 0x5c]
mov ecx, esp
fld1
mov dword [esp + 0x18], esp
fst dword [esi + 0x20]
push 0x5a8554
fxch st(1)
mov byte [esp + 0x2c], 3
fst dword [esi + 0x24]
mov dword [esi + 4], eax
fxch st(1)
mov dword [esi + 0x28], ebx
fstp dword [esi + 0x6c]
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
fstp dword [esi + 0x60]
call fcn.00496da0
mov eax, dword [str.textspriterender]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x30], 5
call fcn.00496da0
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x30], 3
call fcn.00499f00
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x24], 6
call fcn.00497000
test eax, eax
setg dl
lea ecx, [esp + 0xc]
mov byte [esi + 0x70], dl
mov byte [esp + 0x24], 3
call fcn.00497320
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4b69a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59d193
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0x74
mov dword [esp + 0x18], 0
call fcn.0055d3fe
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x14], 1
je 0x4b69ec
mov ecx, eax
call fcn.004b54f0
mov esi, eax
jmp 0x4b69ee
xor esi, esi
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, esi
mov byte [esp + 0x18], 0
mov dword [esi + 0x68], eax
call fcn.004b6880
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x48], edx
mov ecx, dword [eax]
mov dword [esi + 0x4c], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x50], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x54], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov dword [esi + 0x58], edx
call fcn.004971d0
mov ecx, esi
call fcn.004b6930
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00497320
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4bb370
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x59dae8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
call fcn.004989b0
push str.final.txt
lea ecx, [esp + 0x18]
call fcn.00496da0
cmp byte [0x6142b8], 0
mov dword [esp + 0x2c], 0
je 0x4bb3c9
push str.firstpeek.txt
lea ecx, [esp + 0x18]
call fcn.00497d30
push 0x5c7b20
lea ecx, [esp + 0x18]
call fcn.00496ed0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00496da0
call fcn.004fff40
add esp, 4
push eax
call fcn.0055fc24
mov esi, eax
add esp, 8
test esi, esi
je 0x4bb45d
push 2
push 0
push esi
call fcn.0055fdad
push esi
call fcn.0056015a
push 0
push 0
push esi
mov edi, eax
call fcn.0055fdad
add esp, 0x1c
cmp edi, 0x186a0
jge 0x4bb454
lea eax, [edi + 1]
push eax
call fcn.0055ce46
push esi
push 1
mov ebp, eax
push edi
push ebp
call fcn.00560425
add esp, 0x14
cmp eax, 1
jne 0x4bb443
mov byte [edi + ebp], 0
push 1
push ebp
call fcn.004bad90
push ebp
call fcn.0055f5cf
add esp, 0xc
push esi
call fcn.0055fcaa
add esp, 4
or esi, 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], esi
call fcn.00497320
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x5a8554
call fcn.00496da0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.assets
mov dword [esp + 0x38], 1
call fcn.00496da0
mov dword [esp + 0x34], esi
call fcn.004baee0
add esp, 8
push 0x5b2e20
lea ecx, [esp + 0x1c]
call fcn.00496da0
lea ecx, [esp + 0x18]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5a8554
mov dword [esp + 0x38], 2
call fcn.00496da0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.activex
mov byte [esp + 0x3c], 3
call fcn.00496da0
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x3c], 2
call fcn.00499f00
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x30], 4
call fcn.004972e0
lea ecx, [esp + 0x1c]
mov bl, al
mov byte [esp + 0x2c], 2
call fcn.00497320
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], esi
call fcn.00497320
test bl, bl
jne 0x4bb5b0
mov ecx, 0x6142d0
call fcn.00496eb0
test eax, eax
je 0x4bb56c
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.user:
call fcn.00496da0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x6142d0
mov dword [esp + 0x38], 5
call fcn.004971d0
mov dword [esp + 0x34], esi
call fcn.004baee0
add esp, 8
mov ecx, 0x6142d4
call fcn.00496eb0
test eax, eax
je 0x4bb5b0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.common:
call fcn.00496da0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x6142d4
mov dword [esp + 0x38], 6
call fcn.004971d0
mov dword [esp + 0x34], esi
call fcn.004baee0
add esp, 8
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4c33d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59ea86
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi], vtable.TSound.0
mov dword [edi + 0xc], ebx
mov dword [esp + 0x2c], ebx
mov dword [edi + 0x10], ebx
push 0x24
mov byte [esp + 0x30], 1
call fcn.0055d3fe
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x2c], 2
je 0x4c343c
mov ecx, eax
call fcn.004c2c30
mov esi, eax
jmp 0x4c343e
xor esi, esi
mov byte [esp + 0x14], bl
mov eax, dword [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x34], 1
mov dword [esp + 0x24], esi
call fcn.004c0bc0
push esi
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.004b1c50
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov dword [edi + 0xc], edx
cmp ebp, dword [edi + 0x10]
mov byte [esp + 0x2c], 3
je 0x4c34b4
cmp ebp, ebx
je 0x4c3486
add dword [ebp + 4], 1
mov esi, dword [edi + 0x10]
cmp esi, ebx
je 0x4c34b1
add dword [esi + 4], 0xffffffff
cmp dword [esi + 4], ebx
jne 0x4c34b1
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
add dword [esi + 8], 0xffffffff
cmp dword [esi + 8], ebx
jne 0x4c34b1
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov dword [edi + 0x10], ebp
cmp ebp, ebx
mov byte [esp + 0x2c], 1
je 0x4c34dd
add dword [ebp + 4], 0xffffffff
jne 0x4c34dd
mov eax, dword [ebp]
mov edx, dword [eax + 4]
mov ecx, ebp
call edx
add dword [ebp + 8], 0xffffffff
jne 0x4c34dd
mov eax, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, ebp
call edx
mov eax, dword [edi + 0xc]
mov dword [eax + 0x20], edi
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x4c4330
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor eax, eax
xor ecx, ecx
test esi, esi
mov dword [esp], eax
jle 0x4c4358
lea esp, [esp]
mov dl, byte [ecx + edi]
mov eax, ecx
and eax, 3
xor byte [esp + eax], dl
lea eax, [esp + eax]
add ecx, 1
cmp ecx, esi
jl 0x4c4340
mov eax, dword [esp]
pop ecx
ret
Function at 0x4cdd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0x78], ebx
lea edi, [esi + 0x50]
mov ebp, 3
lea esp, [esp]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4cdd7a
fild dword [esi + 0x78]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
fstp qword [esp + 0x18]
call edx
test eax, eax
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
jge 0x4cdd46
fadd dword [0x5aa24c]
fmul dword [esi + 0x6c]
fcomp qword [esp + 0x18]
fnstsw ax
test ah, 0x41
jne 0x4cdd7a
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
test eax, eax
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
jge 0x4cdd6f
fadd dword [0x5aa24c]
fmul dword [esi + 0x6c]
call fcn.0055d2f0
mov dword [esi + 0x78], eax
add edi, 8
sub ebp, 1
jne 0x4cdd20
mov ecx, dword [esi + 0x3c]
cmp ecx, ebx
je 0x4cddce
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.0049eb50
mov eax, dword [esi + 0x74]
cdq
xor eax, edx
sub eax, edx
cmp byte [esi + 0x7c], bl
je 0x4cddbc
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x1c]
add eax, ecx
jmp 0x4cddc6
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x18]
add eax, edx
cmp dword [esi + 0x78], eax
jge 0x4cddce
mov dword [esi + 0x78], eax
cmp byte [esi + 0x7c], bl
mov eax, dword [esi + 0x78]
je 0x4cdded
mov ecx, dword [esi + 0x1c]
sub ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0049f280
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x20]
sub edx, dword [esi + 0x18]
mov ecx, esi
push edx
push eax
call fcn.0049f280
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ce580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a005f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004a0090
push fcn.00401370
push 0x414550
push 2
xor ebx, ebx
push 8
lea eax, [esi + 0x40]
push eax
mov dword [esp + 0x30], ebx
mov dword [esi], vtable.TSlider.0
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
call fcn.0055d9bb
push fcn.00401370
push 0x414550
push 3
push 8
lea ecx, [esi + 0x50]
push ecx
mov byte [esp + 0x30], 1
call fcn.0055d9bb
fldz
fstp dword [esi + 0x68]
push 0x4c
fld1
mov byte [esp + 0x20], 2
fst dword [esi + 0x6c]
mov byte [esi + 0x7c], bl
fstp dword [esi + 0x70]
call fcn.0055d3fe
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 3
je 0x4ce641
push 1
mov ecx, eax
call fcn.0049e150
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4cf6e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0351
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
push 0x5c8504
push ecx
mov dword [esp + 0x30], 0
mov dword [esp + 0x20], 0
call fcn.00497f10
add esp, 0xc
mov esi, eax
mov edx, dword [str.pflifetime]
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.00496da0
push esi
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
mov byte [esp + 0x2c], 2
call fcn.004974a0
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.00497320
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 5
call fcn.00497320
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.004971d0
mov esi, dword [esp + 0x30]
push esi
call fcn.004cf310
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
call fcn.00497320
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret

Function at 0x4d2ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0720
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0
call fcn.00496d90
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0xc]
push 0x5a9180
push ecx
mov byte [esp + 0x24], 1
call fcn.00498110
mov edx, dword [esp + 0x34]
add esp, 0xc
push edx
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004971d0
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x28], 2
call fcn.004971d0
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov byte [esp + 0x28], 1
call fcn.004d2870
mov ecx, eax
mov byte [esp + 0x18], 3
call fcn.00497000
lea ecx, [esp + 0x24]
mov esi, eax
mov byte [esp + 0x18], 1
call fcn.00497320
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00497320
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00497320
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0xc
Function at 0x4d38e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0908
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.00496d90
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0xc]
push 0x5a9180
push ecx
mov byte [esp + 0x20], 1
call fcn.00498110
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
add esp, 0xc
push edx
push eax
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.004971d0
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x28], 2
call fcn.004971d0
mov ecx, esi
mov byte [esp + 0x24], 1
call fcn.004d35b0
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.00497320
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00497320
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x4d5a10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5a0cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x40]
add eax, 0x3c
mov ecx, edx
mov edi, dword [ecx]
mov ecx, dword [esp + 0x30]
mov ebx, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
cmp edi, edx
je 0x4d5a6d
cmp dword [edi + 8], ecx
je 0x4d5a6d
mov edi, dword [edi]
jmp 0x4d5a60
cmp eax, eax
je 0x4d5a76
call fcn.0055d776
mov eax, dword [esi + 4]
mov ebp, dword [eax + 0x40]
add eax, 0x3c
test ebx, ebx
je 0x4d5a87
cmp ebx, eax
je 0x4d5a8c
call fcn.0055d776
cmp edi, ebp
je 0x4d5ae9
test ebx, ebx
jne 0x4d5a99
call fcn.0055d776
cmp edi, dword [ebx + 4]
jne 0x4d5aa3
call fcn.0055d776
mov esi, dword [esi + 4]
mov ebx, dword [esi + 0x68]
add esi, 0x64
lea eax, [edi + 8]
push eax
mov eax, dword [ebx + 4]
push eax
push ebx
mov ecx, esi
call fcn.004d53c0
push 1
mov ecx, esi
mov ebp, eax
call fcn.004d57c0
mov ecx, dword [esp + 0x18]
mov dword [ebx + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
mov eax, dword [esp + 0x14]
push edi
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 0x20]
push edx
add ecx, 0x3c
call fcn.004d5410
mov esi, dword [esp + 0x34]
or edi, 0xffffffff
test esi, esi
mov dword [esp + 0x28], edi
je 0x4d5b14
add dword [esi + 4], edi
jne 0x4d5b14
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
add dword [esi + 8], edi
jne 0x4d5b14
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x4d5cf0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5a0d71
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x60aecc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
lea edi, [esi + 0x3c]
mov ecx, edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004d5270
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
fld1
lea edi, [esi + 0x4c]
fstp dword [esi + 0x48]
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.004146a0
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x64]
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.004d5270
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
push 1
mov byte [esp + 0x20], 2
mov dword [esi + 0x70], ebx
call fcn.0055d3fe
add esp, 4
push str.TSoundManagerMutex
push ebx
mov dword [esi + 0x60], eax
push ebx
mov byte [eax], bl
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov dword [esi + 0x74], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4d62f0
Capabilities:
Create thread

Disassembly:
sub esp, 0x9c
mov eax, dword [0x60aecc]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x4d6325
mov al, 1
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0055d2d5
add esp, 0x9c
ret
mov eax, dword [esi + 4]
push edi
lea ecx, [eax + 0x58]
push ecx
push 0
push eax
push 0x4d6270
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edx, dword [esi + 4]
lea edi, [esi + 8]
mov ecx, edi
mov dword [edx + 0x5c], eax
call fcn.004d8f20
mov ecx, edi
call fcn.004d8ed0
xor eax, eax
push eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov eax, dword [esi + 4]
push eax
push 0
call sub.DSOUND.dll_DirectSoundCreate
mov edi, eax
test edi, edi
je 0x4d63c7
cmp edi, 0x8876017c
jne 0x4d63bd
call fcn.004988c0
mov ecx, eax
call fcn.004988b0
push 0xa3
jmp 0x4d647d
push 0x60
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.0055da20
mov edx, dword [esi + 4]
mov dword [esp + 0x28], 0x60
mov eax, dword [edx]
mov ecx, dword [eax]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
call fcn.004988c0
mov ecx, dword [eax]
mov edx, dword [esi + 4]
mov eax, dword [edx]
mov ecx, dword [ecx + 0x12b4]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 2
push ecx
push eax
call edx
mov edi, eax
test edi, edi
je 0x4d6430
cmp edi, 0x8876017c
jne 0x4d6429
call fcn.004988c0
mov ecx, eax
call fcn.004988b0
push 0xb2
jmp 0x4d647d
mov eax, dword [esi + 4]
mov dword [esp + 0x7c], 0x24
mov dword [esp + 0x80], 1
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0
add eax, 4
push eax
lea eax, [esp + 0x84]
push eax
push ecx
mov ecx, dword [edx + 0xc]
call ecx
mov edi, eax
test edi, edi
je 0x4d64ae
cmp edi, 0x8876017c
jne 0x4d6478
call fcn.004988c0
mov ecx, eax
call fcn.004988b0
push 0xb7
push str.._soundmanager.cpp
push edi
push 0x5a8554
push 0x5c85f0
call fcn.004dfae0
add esp, 0x14
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0055d2d5
add esp, 0x9c
ret
mov edx, dword [esi + 4]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov word [esp + 0x18], ax
mov word [esp + 8], 1
mov word [esp + 0xa], 2
mov dword [esp + 0xc], 0xac44
mov word [esp + 0x16], 0x10
mov word [esp + 0x14], 4
mov dword [esp + 0x10], 0x2b110
mov eax, dword [edx + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x38]
call eax
mov ecx, dword [esp + 0xa0]
pop edi
mov byte [esi + 0x20], 1
pop esi
xor ecx, esp
mov al, 1
call fcn.0055d2d5
add esp, 0x9c
ret