joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c0f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5f9fbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push eax
mov dword [esp + 0x14], esi
mov dword [esi], 0x60d548
mov dword [esi + 4], eax
call fcn.0042b6b0
mov dword [esi + 8], eax
mov eax, dword [esp + 0x34]
add esp, 4
xor ebx, ebx
push eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
push esi
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], ebx
call fcn.00424400
push ebx
push ebx
lea edi, [esi + 0x2c]
push ebx
mov ecx, edi
mov dword [esp + 0x30], ebx
call fcn.00470260
lea ebp, [esi + 0x6c]
push 0x10
mov byte [esp + 0x28], 1
mov dword [ebp], ebx
call fcn.00401cc0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp], eax
mov byte [esi + 0x70], bl
mov byte [esi + 0x7c], bl
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov byte [esi + 0x8c], bl
mov dword [esi + 0x90], ebx
mov byte [esi + 0x9c], bl
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
push 0x28
mov byte [esp + 0x2c], 2
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
call fcn.005d0282
add esp, 8
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov byte [esp + 0x24], 3
je 0x42c1d2
push 0xffffffffffffffff
mov ecx, eax
call fcn.0046e8f0
jmp 0x42c1d4
xor eax, eax
mov byte [esp + 0x2c], bl
mov ecx, dword [esp + 0x2c]
push ecx
push eax
lea ecx, [esi + 0xb4]
mov byte [esp + 0x2c], 2
mov dword [esi + 0xb0], eax
call fcn.0042b620
mov eax, dword [esi + 8]
cmp eax, ebx
mov byte [esp + 0x24], 4
je 0x42c20a
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.004715e0
cmp dword [esi + 0x28], ebx
je 0x42c281
push 0x24
call fcn.005d0282
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov byte [esp + 0x24], 5
je 0x42c230
push esi
mov ecx, eax
call fcn.004367f0
jmp 0x42c232
xor eax, eax
mov byte [esp + 0x2c], bl
mov edx, dword [esp + 0x2c]
push edx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 4
mov dword [esp + 0x1c], eax
call fcn.0042b3a0
mov edi, dword [ebp]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
mov byte [esp + 0x28], 6
call fcn.00445610
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [eax], edi
mov dword [ecx], eax
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
mov dword [edi + 4], eax
mov byte [esp + 0x24], 4
je 0x42c281
call fcn.0041ba80
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 8
Function at 0x438d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fafd9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x60d93c
mov byte [esi + 4], bl
lea edi, [esi + 8]
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.00443da0
mov dword [esi], 0x60dc30
mov dword [edi], 0x60dc20
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x20], ecx
lea edi, [esi + 0x28]
mov ecx, edi
mov byte [esp + 0x1c], 2
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], edx
call fcn.004cb350
mov ecx, dword [0x655e00]
mov eax, dword [ecx]
xor ebp, ebp
cmp eax, ecx
mov byte [esp + 0x1c], 3
je 0x438db8
mov eax, dword [eax]
inc ebp
cmp eax, ecx
jne 0x438db1
mov ecx, dword [esp + 0x24]
call fcn.0047f1a0
cmp eax, ebp
jne 0x438dee
cmp edi, 0x655f2c
je 0x438de7
mov ecx, dword [0x655f30]
mov edx, dword [0x655f2c]
lea eax, [esp + 0x24]
push eax
push ecx
push edx
mov ecx, edi
call fcn.0040c800
mov eax, dword [0x655f38]
jmp 0x438e59
mov ebp, dword [esp + 0x24]
mov ecx, ebp
call fcn.0047f060
test al, al
je 0x438e32
mov ecx, dword [ebp + 0x7634]
mov dword [esp + 0x24], ecx
fld dword [esp + 0x24]
fcomp dword [0x60c748]
fnstsw ax
test ah, 0x41
jp 0x438e32
mov edx, dword [esp + 0x30]
cmp byte [edx + 0x7094], bl
jne 0x438e32
push 0x655f3c
mov ecx, edi
call fcn.004380e0
jmp 0x438e5c
cmp edi, 0x655f1c
je 0x438e54
mov ecx, dword [0x655f20]
mov edx, dword [0x655f1c]
lea eax, [esp + 0x24]
push eax
push ecx
push edx
mov ecx, edi
call fcn.0040c800
mov eax, dword [0x655f28]
mov dword [edi + 0xc], eax
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x438ea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fb01f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [edi + 0x28]
mov eax, dword [edi + 0x30]
sub eax, esi
test esi, esi
mov dword [esp + 0x18], 1
je 0x438f14
cmp eax, 0x80
jbe 0x438ee6
push esi
call fcn.005e05ca
add esp, 4
jmp 0x438f14
push ebp
lea ebp, [eax - 1]
shr ebp, 3
push 0x655bd8
lea ebp, [ebp*4 + 0x655be0]
call fcn.00401450
mov eax, dword [ebp]
mov dword [esi], eax
add esp, 4
mov dword [ebp], esi
mov dword [0x655bd8], 0
pop ebp
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x438f20
call fcn.0041ba80
test edi, edi
mov byte [esp + 0x18], 0
je 0x438f2e
lea ecx, [edi + 8]
jmp 0x438f30
xor ecx, ecx
call fcn.00443e10
mov ecx, dword [esp + 0x10]
mov dword [edi], 0x60d93c
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x43ef90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5fb5f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x3c]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
call fcn.0043e3f0
mov edi, eax
mov eax, dword [esi + 8]
xor ecx, ecx
push eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call fcn.0041e090
add esp, 0x10
push edi
lea ecx, [esp + 0xc]
call fcn.0041d840
lea ecx, [esp + 0x10]
call fcn.00478750
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8

Function at 0x43f010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5fb5f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x3c]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
call fcn.0043e420
mov edi, eax
mov eax, dword [esi + 8]
xor ecx, ecx
push eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call fcn.0041e090
add esp, 0x10
push edi
lea ecx, [esp + 0xc]
call fcn.0041d840
lea ecx, [esp + 0x10]
call fcn.00478750
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8

Function at 0x43f570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fb618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov eax, dword [0x65480c]
mov dword [esp + 0x54], eax
push ebx
xor ebx, ebx
mov ecx, 3
mov eax, 0x64fbc8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov byte [esp + 0x54], bl
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x64f734
mov dword [esp + 0x14], ecx
mov cx, word [esp + 0x70]
mov eax, dword [esp + 0x70]
mov word [esp + 8], cx
mov edx, dword [esp + 8]
push edx
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x18], 0x43c020
call fcn.0043d170
mov ecx, dword [esp + 0x6c]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x14], 0x43f470
call fcn.004200c0
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x64], 0xffffffff
pop ebx
je 0x43f62b
mov edx, dword [esp + 0x18]
push 1
push edx
call eax
add esp, 8
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x54]
call fcn.005e149c
add esp, 0x64
ret
Function at 0x43f890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fb618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov eax, dword [0x65480c]
mov dword [esp + 0x54], eax
push ebx
xor ebx, ebx
mov eax, 2
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov byte [esp + 0x54], bl
mov dword [esp + 0x2c], 0x64fbc8
mov dword [esp + 0x30], 0x64fbbc
mov dword [esp + 0x14], eax
mov cx, word [esp + 0x70]
mov eax, dword [esp + 0x70]
mov word [esp + 8], cx
mov edx, dword [esp + 8]
push edx
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x18], 0x43bf80
call fcn.0043d050
mov ecx, dword [esp + 0x6c]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x14], 0x43f850
call fcn.004200c0
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x64], 0xffffffff
pop ebx
je 0x43f946
mov edx, dword [esp + 0x18]
push 1
push edx
call eax
add esp, 8
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x54]
call fcn.005e149c
add esp, 0x64
ret

Function at 0x43f960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fb618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov eax, dword [0x65480c]
mov dword [esp + 0x54], eax
push ebx
xor ebx, ebx
mov eax, 3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov byte [esp + 0x54], bl
mov dword [esp + 0x2c], 0x64fbc8
mov dword [esp + 0x30], 0x64f734
mov dword [esp + 0x34], 0x64fbbc
mov dword [esp + 0x14], eax
mov cx, word [esp + 0x70]
mov eax, dword [esp + 0x70]
mov word [esp + 8], cx
mov edx, dword [esp + 8]
push edx
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x18], 0x43bfd0
call fcn.0043d0e0
mov ecx, dword [esp + 0x6c]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x14], 0x43f870
call fcn.004200c0
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x64], 0xffffffff
pop ebx
je 0x43fa1e
mov edx, dword [esp + 0x18]
push 1
push edx
call eax
add esp, 8
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x54]
call fcn.005e149c
add esp, 0x64
ret
Function at 0x440f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fb76c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x36c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x388]
push edi
push esi
call fcn.004a9e90
push esi
call fcn.00421230
push esi
call fcn.004829d0
add esp, 0xc
push str.globals_class
lea ecx, [esp + 0x26c]
call fcn.0041f290
xor ebx, ebx
lea ecx, [esp + 0x268]
mov dword [esp + 0x268], 0x60df78
mov dword [esp + 0x378], ebx
call fcn.0043bdc0
push str.music_interface
lea ecx, [esp + 0x44]
mov dword [esp + 0x388], ebx
call fcn.0041f290
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0x60df6c
mov dword [esp + 0x150], ebx
call fcn.0043bd60
push str.player_class
lea ecx, [esp + 0x158]
mov byte [esp + 0x388], 1
call fcn.0041f290
lea ecx, [esp + 0x154]
mov dword [esp + 0x154], 0x60df60
mov dword [esp + 0x264], ebx
call fcn.0043d610
lea eax, [esp + 0x40]
push eax
push 0x43ba80
push str.fade_in
mov byte [esp + 0x390], 2
call fcn.0043f890
lea ecx, [esp + 0x4c]
push ecx
push 0x43baa0
push str.fade_out
call fcn.0043f960
lea edx, [esp + 0x58]
push edx
push 0x43bac0
push str.set_song_volume
call fcn.0043f890
lea eax, [esp + 0x64]
push eax
push 0x43bae0
push str.set_song_max_volume
call fcn.0043f890
lea ecx, [esp + 0x70]
push ecx
push 0x43bb00
push str.play
call fcn.0043f570
lea edx, [esp + 0x7c]
push edx
push 0x43bb10
push str.stop
call fcn.0043f3a0
add esp, 0x48
lea eax, [esp + 0x154]
push eax
push 0x43ba70
push str.feedback_occur
call fcn.0043f2e0
add esp, 0xc
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x15c]
call fcn.0043ce10
mov edi, eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x26c]
mov byte [esp + 0x388], 3
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0x43bc80
mov dword [esp + 0x24], 0x43be70
mov dword [esp + 0x20], 0x49a5e0
mov dword [esp + 0x28], ebx
call fcn.0043ce40
push 0x43bb60
push str.fade_time
push fcn.0043f1e0
push str.player
push 0x43bb50
push str.music
push 0x43bb40
push str.level
push 0x43bb30
push str.bird_controller
push 0x43bb20
push str.pipeline
lea ecx, [esp + 0x298]
call fcn.0043e8d0
mov ecx, eax
call fcn.0043e9b0
mov ecx, eax
call fcn.0043ea90
mov ecx, eax
call fcn.0043eb70
mov ecx, eax
call fcn.0043ec50
mov ecx, eax
call fcn.0043d420
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov edx, dword [edi + 8]
mov ebp, dword [edi + 0xc]
cmp edx, ebp
lea ecx, [edi + 4]
mov dword [esp + 0x14], eax
je 0x4411bd
cmp edx, ebx
je 0x4411b7
mov dword [edx], eax
add dword [ecx + 4], 4
jmp 0x4411d1
push 1
push 1
lea eax, [esp + 0x1b]
push eax
lea eax, [esp + 0x20]
push eax
push edx
call fcn.00486f20
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
call fcn.0041e090
add esp, 4
push edi
lea ecx, [esp + 0x18]
call fcn.0041d840
lea ecx, [esp + 0x30]
mov byte [esp + 0x384], 2
call fcn.0043caf0
lea ecx, [esp + 0x154]
mov byte [esp + 0x384], 1
call fcn.0043e0d0
lea ecx, [esp + 0x40]
mov byte [esp + 0x384], bl
call fcn.0043e170
lea ecx, [esp + 0x268]
mov dword [esp + 0x384], 0xffffffff
call fcn.0043e210
mov ecx, dword [esp + 0x37c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x378
ret
Function at 0x4458a6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fbc84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x60e308
mov dword [esi + 4], 0x60e2fc
lea ecx, [esi + 0x1b0]
mov dword [esp + 0x14], 7
call fcn.0046eaf0
lea ecx, [esi + 0x188]
mov byte [esp + 0x14], 6
call fcn.0046eaf0
lea edi, [esi + 0x184]
mov ecx, edi
mov byte [esp + 0x14], 5
call fcn.00437810
mov edi, dword [edi]
test edi, edi
je 0x44591a
push 0x655bd8
call fcn.00401450
mov eax, dword [0x655be4]
mov dword [edi], eax
mov dword [0x655be4], edi
add esp, 4
mov dword [0x655bd8], 0
lea ecx, [esi + 0x130]
mov byte [esp + 0x14], 4
call fcn.0046fd20
lea ecx, [esi + 0xf0]
mov byte [esp + 0x14], 3
call fcn.0046fd20
lea ecx, [esi + 0xb0]
mov byte [esp + 0x14], 2
call fcn.0046fd20
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 1
call fcn.0046fd20
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.0046fd20
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00443e10
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4459b6
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5fbcda
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00402680
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], edi
call fcn.00402680
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 1
call fcn.00402680
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 2
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.00402680
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 3
call fcn.00402680
push fcn.0041d780
push fcn.00402680
push 3
push 0xc
lea eax, [esi + 0x68]
push eax
mov byte [esp + 0x28], 4
call fcn.005e16dc
push fcn.0041d780
push fcn.00402680
push 3
push 0xc
lea ecx, [esi + 0x8c]
push ecx
mov byte [esp + 0x28], 5
call fcn.005e16dc
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x44a250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5fc260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x13]
push eax
push str.fire
lea ecx, [esp + 0x20]
call fcn.00402f20
mov ebx, dword [esp + 0x40]
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x3c], 0
call fcn.005b8470
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x20]
sub eax, ecx
test ecx, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x38], 0xffffffff
mov esi, ecx
je 0x44a2ee
cmp eax, 0x80
jbe 0x44a2c4
push ecx
call fcn.005e05ca
jmp 0x44a2eb
lea edi, [eax - 1]
shr edi, 3
push 0x655bd8
lea edi, [edi*4 + 0x655be0]
call fcn.00401450
mov edx, dword [edi]
mov dword [esi], edx
mov dword [edi], esi
mov dword [0x655bd8], 0
add esp, 4
xor edi, edi
test ebp, ebp
jle 0x44a3ef
jmp 0x44a300
lea eax, [esp + 0x13]
push eax
push str.fire
lea ecx, [esp + 0x2c]
call fcn.00402f20
push 0x655fe8
push 0x656050
push 0x656044
push 0x656038
push 0x655ff4
push 0x655fdc
push 0x656074
push 0x656068
push 0x65605c
push 0x655ffc
push 0x655fd0
push 0x656034
push 0x656028
push 0x656030
push 0x656024
push 0x65602c
push 0x656020
push 0x656004
push 0x656014
push 0x656008
push edi
lea ecx, [esp + 0x78]
push ecx
mov ecx, ebx
mov dword [esp + 0x90], 1
call fcn.00449c00
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
sub eax, ecx
test ecx, ecx
mov dword [esp + 0x38], 0xffffffff
mov esi, ecx
je 0x44a3e6
cmp eax, 0x80
jbe 0x44a3b6
push ecx
call fcn.005e05ca
jmp 0x44a3e3
lea ebp, [eax - 1]
shr ebp, 3
push 0x655bd8
lea ebp, [ebp*4 + 0x655be0]
call fcn.00401450
mov edx, dword [ebp]
mov dword [esi], edx
mov dword [ebp], esi
mov ebp, dword [esp + 0x18]
mov dword [0x655bd8], 0
add esp, 4
inc edi
cmp edi, ebp
jl 0x44a300
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x44a410
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5fc2ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
call fcn.00443da0
mov dword [esi + 4], 0x60ff2c
xor ebx, ebx
mov dword [esi], 0x60e308
mov dword [esi + 4], 0x60e2fc
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
push ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [0x656004]
push ebx
lea edi, [esi + 0x30]
push 0x656008
mov ecx, edi
mov dword [esp + 0x3c], ebx
mov dword [esi + 0x2c], eax
call fcn.004712c0
push ebx
push ebx
push 0x655fd0
lea ecx, [esi + 0x70]
mov byte [esp + 0x3c], 1
call fcn.004712c0
lea ecx, [esp + 0x13]
push ecx
push 0x60e4f0
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 2
call fcn.00402f20
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
lea ecx, [esi + 0xb0]
mov byte [esp + 0x3c], 3
call fcn.004712c0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
sub eax, ecx
cmp ecx, ebx
mov byte [esp + 0x30], 5
mov ebp, ecx
je 0x44a519
cmp eax, 0x80
jbe 0x44a4ec
push ecx
call fcn.005e05ca
jmp 0x44a516
dec eax
shr eax, 3
lea eax, [eax*4 + 0x655be0]
push 0x655bd8
mov dword [esp + 0x18], eax
call fcn.00401450
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [ebp], ecx
mov dword [eax], ebp
mov dword [0x655bd8], ebx
add esp, 4
push ebx
push ebx
push 0x655fdc
lea ecx, [esi + 0xf0]
call fcn.004712c0
push ebx
push ebx
push 0x655fe8
lea ecx, [esi + 0x130]
mov byte [esp + 0x3c], 6
call fcn.004712c0
mov byte [esi + 0x170], bl
mov byte [esi + 0x171], bl
mov byte [esi + 0x172], bl
mov byte [esi + 0x173], bl
mov dword [esi + 0x174], ebx
mov byte [esi + 0x178], bl
mov dword [esi + 0x17c], ebx
push 0x10
mov byte [esp + 0x34], 7
mov dword [esi + 0x184], ebx
call fcn.00401cc0
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0x184], eax
push 0xe
lea ecx, [esi + 0x188]
mov byte [esp + 0x34], 8
call fcn.0046e8f0
push 0xf
lea ecx, [esi + 0x1b0]
mov byte [esp + 0x34], 9
call fcn.0046e8f0
fld dword [esi + 0x4c]
mov byte [esp + 0x30], 0xa
call fcn.005e0b1c
fld dword [esi + 0x50]
mov dword [esi + 0x24], eax
call fcn.005e0b1c
mov dword [esi + 0x28], eax
cmp dword [0x655df8], ebx
jne 0x44a5f7
cmp byte [0x655df4], bl
je 0x44a5e0
jmp fcn.00423b30
call fcn.00421ce0
push 0x4231e0
mov dword [0x655df8], eax
call fcn.005e0ca0
add esp, 4
mov edx, dword [0x655df8]
mov eax, dword [edx + 0x5c]
push eax
mov ecx, esi
call fcn.0044a120
mov ecx, esi
call fcn.00449a50
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x28]
or eax, 0x10
mov dword [edi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x44efa0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5fc746
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [edi], 0x60e768
xor ebx, ebx
push 0xcc
mov dword [esp + 0x28], edi
mov dword [edi + 4], ebx
call fcn.005d0282
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
push 0xd8
mov dword [esp + 0x38], ebx
mov dword [edi + 8], ebx
call fcn.005d0282
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 8
mov dword [edi + 8], eax
mov byte [esp + 0x30], 1
lea esi, [edi + 0xc]
mov ebp, 0x320
jmp 0x44f010
push fcn.00401040
push 3
push 8
push esi
call fcn.0042abd0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
add esi, 0x24
dec ebp
jne 0x44f010
mov dword [edi + 0x708c], ebx
mov dword [edi + 0x7090], ebx
mov byte [edi + 0x7094], bl
mov dword [edi + 0x7098], ebx
mov dword [edi + 0x709c], ebx
mov dword [edi + 0x70a0], ebx
mov dword [edi + 0x70a4], ebx
mov dword [edi + 0x70ac], ebx
fild dword [0x64fdd0]
mov dword [esp + 0x10], ebx
lea eax, [edi + 0xc]
fstp dword [edi + 0x70b0]
mov edi, edi
fild dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x18], ebx
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
mov dword [esp + 0x20], edx
fdiv dword [0x60c3b4]
fmul dword [0x60d860]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
mov ebp, dword [esp + 0x14]
fadd dword [0x60d860]
fstp dword [esp + 0x1c]
fld dword [esp + 0x14]
fadd dword [0x60c7bc]
fstp dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
lea ebx, [ebx]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
add esi, ebx
and esi, 0x80000001
mov byte [eax + 0x20], 1
mov byte [eax + 0x21], 1
jns 0x44f0df
dec esi
or esi, 0xfffffffe
inc esi
mov dword [eax + 0x18], ecx
mov dword [eax], ebp
jne 0x44f12d
lea esi, [edx + 0x23]
mov dword [esp + 0x24], esi
fild dword [esp + 0x24]
mov dword [eax + 8], ecx
mov byte [eax + 0x22], 1
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
mov esi, dword [esp + 0x14]
fsub dword [0x60d45c]
mov dword [eax + 4], esi
fstp dword [esp + 0x14]
mov ebx, dword [esp + 0x14]
fld dword [esp + 0x14]
fadd dword [0x60e764]
mov dword [eax + 0xc], ebx
mov ebx, dword [esp + 0x1c]
mov dword [eax + 0x10], ebx
xor ebx, ebx
jmp 0x44f16a
fild dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov dword [eax + 8], ebx
xor ebx, ebx
fstp dword [esp + 0x14]
mov dword [eax + 0x10], ecx
fld dword [esp + 0x14]
mov esi, dword [esp + 0x14]
fadd dword [0x60d45c]
mov dword [eax + 4], esi
mov dword [eax + 0xc], esi
mov byte [eax + 0x22], bl
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
mov esi, dword [esp + 0x14]
fsub dword [0x60e764]
mov dword [eax + 0x14], esi
fstp dword [eax + 0x1c]
mov esi, dword [esp + 0x18]
add edx, 0x23
inc esi
add eax, 0x24
cmp edx, 0x2bc
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], edx
jl 0x44f0c0
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, 0x28
mov dword [esp + 0x10], ecx
jl 0x44f070
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret