joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4019fd
push 1
lea ecx, [ebp - 1]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x401a11
mov edx, dword [esi + 0x38]
push edx
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.005ea827
add esp, 0x10
cmp eax, 1
jne 0x401a59
mov cl, byte [ebp - 1]
test cl, cl
jbe 0x401a67
lea eax, [esi + 0x44]
mov byte [eax], cl
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x3c]
mov dword [ebx], eax
inc eax
test edx, edx
je 0x401a3d
movzx ecx, byte [ebp - 1]
push ecx
push eax
push edi
call edx
add esp, 0xc
jmp 0x401a51
mov edx, dword [ecx + 0x38]
movzx ecx, byte [ebp - 1]
push edx
push ecx
push 1
push eax
call fcn.005ea827
add esp, 0x10
movzx edx, byte [ebp - 1]
cmp eax, edx
je 0x401a78
mov dword [edi + 0x40], 0x66
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
mov byte [esi + 0x44], 0
mov dword [esi + 0x34], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x401ab3
push 1
lea ecx, [ebp - 1]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x401ac7
mov edx, dword [esi + 0x38]
push edx
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.005ea827
add esp, 0x10
cmp eax, 1
jb 0x401adc
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jle 0x401ae5
mov dword [edi + 0x40], 0x66
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [esi]
push edi
test cl, cl
jne 0x401f23
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x401ea3
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x401eb4
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call fcn.005ea827
add esp, 0x10
cmp eax, 1
je 0x401ec5
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop edi
pop ebp
ret
mov al, byte [esi]
test al, al
jne 0x401ed7
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x48]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x401ef1
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x401f04
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call fcn.005ea827
add esp, 0x10
mov cl, byte [esi]
movzx edx, cl
cmp eax, edx
jne 0x401eb9
mov al, byte [edi]
mov edx, dword [ebp + 8]
dec cl
mov byte [edx], al
mov byte [edi], 2
mov byte [esi], cl
mov eax, 1
pop edi
pop ebp
ret
mov al, byte [esi + 1]
mov edi, dword [ebp + 8]
movzx edx, al
mov dl, byte [edx + esi]
inc al
dec cl
mov byte [edi], dl
mov byte [esi + 1], al
mov byte [esi], cl
mov eax, 1
pop edi
pop ebp
ret

Function at 0x402ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x8e01a8], 0
jne 0x402f72
jmp 0x402f56
push 0
push 0
push 0
push 0x402eb0
push 0
push 0
mov byte [0x8e01a8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x402fd8
push 0xa
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov edx, eax
shr edx, 0x10
mov ecx, esi
call fcn.00402c10
mov ecx, dword [ebp + 8]
xor byte [ecx], al
jmp 0x403062
push 0x14
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov dl, al
mov ecx, esi
call fcn.00402c10
xor byte [ebx], al
jmp 0x4030e6
push 0x1e
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov edx, eax
shr edx, 8
mov ecx, esi
call fcn.00402c10
mov ecx, dword [ebp + 0xc]
xor byte [ecx], al
jmp 0x403170
push 0x28
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov edx, eax
shr edx, 0x18
mov ecx, esi
call fcn.00402c10
xor byte [edi], al
jmp 0x4031f7
pop ebp
ret
Function at 0x403200
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x8e01a8], 0
jne 0x403292
jmp 0x403276
push 0
push 0
push 0
push 0x402eb0
push 0
push 0
mov byte [0x8e01a8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4032f8
push 0xa
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov edx, eax
shr edx, 0x10
mov ecx, esi
call fcn.00402c10
mov ecx, dword [ebp + 8]
xor byte [ecx], al
jmp 0x403382
push 0x14
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov dl, al
mov ecx, esi
call fcn.00402c10
xor byte [ebx], al
jmp 0x403406
push 0x1e
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov edx, eax
shr edx, 8
mov ecx, esi
call fcn.00402c10
mov ecx, dword [ebp + 0xc]
xor byte [ecx], al
jmp 0x403490
push 0x28
mov eax, esi
call fcn.00402e30
add esp, 4
mov ecx, eax
call fcn.004029c0
mov edx, eax
shr edx, 0x18
mov ecx, esi
call fcn.00402c10
xor byte [edi], al
pop ebp
ret
Function at 0x407010
Capabilities:
Create process on windows
Create process suspended
Get common file path
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x196c]
mov eax, 0x19ec
call fcn.005e4ed0
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp + 0x1968], eax
mov eax, dword [ebp + 0x1974]
mov ecx, dword [ebp + 0x1978]
push ebx
push esi
push edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jmp 0x4070aa
mov edx, dword [0x8e0224]
mov esi, dword [0x8e0220]
lea eax, [ebp - 0x17]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edi, [ebp - 0x15]
lea ebx, [ebp - 0x16]
mov dword [ebp - 0x18], edx
call fcn.00402ee0
add esp, 8
cmp byte [ebp - 0x18], 0
jne 0x40714a
jmp 0x40713b
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005ece6d
jmp 0x4071b0
xor edi, edi
cmp dword [0x8e01dc], edi
je 0x4071da
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x8e01dc]
cmp eax, 0x493e0
jbe 0x4071da
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
push edi
call fcn.005ece6d
jmp 0x407240
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
lea edx, [ebp - 0x14]
push edx
push edi
push 1
push edi
mov dword [ebp - 0x14], edi
call ebx
mov eax, dword [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x14]
push ecx
push edi
mov esi, eax
push 1
push esi
call ebx
push edi
push edi
push 8
lea edx, [ebp - 0x20]
push edx
push 0x20007
push edi
push esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0x44
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.005e5820
add esp, 0xc
lea ecx, [ebp + 0x1760]
push ecx
push 0x104
mov dword [ebp - 0x80], 0x48
mov dword [ebp - 0x3c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x38]
push edx
push ebx
lea eax, [ebp + 0x1760]
push eax
lea ecx, [ebp - 0x10]
push str.__s_hs___hs
push ecx
mov edx, 0xbb8
call fcn.00402460
add esp, 0x14
push edi
push edi
push 0xffffffffffffffff
push ebx
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005c0a30
add esp, 4
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp + 0x1760]
push edx
push 0
push 0x80004
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp + 0x1968]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005e4a11
add ebp, 0x196c
mov esp, ebp
pop ebp
ret
Function at 0x40e0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
xor edx, edx
push edi
mov ecx, 0x8f
add esi, 0x7e1ae418
mov di, word [esi]
xor di, cx
inc ecx
and ecx, 0x800000ff
mov word [eax + edx*2], di
jns 0x40e0ce
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
add esi, 2
cmp edx, 0xd
jl 0x40e0b3
xor ecx, ecx
pop edi
mov word [eax + 0x1a], cx
pop esi
ret 4

Function at 0x40e0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
xor edx, edx
push edi
mov ecx, 0xd2
add esi, 0x278cbf8a
mov di, word [esi]
xor di, cx
inc ecx
and ecx, 0x800000ff
mov word [eax + edx*2], di
jns 0x40e11e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
add esi, 2
cmp edx, 0x11
jl 0x40e103
xor ecx, ecx
pop edi
mov word [eax + 0x22], cx
pop esi
ret 4

Function at 0x40e2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
xor edx, edx
push edi
mov ecx, 0xc7
add esi, 0x73407540
mov di, word [esi]
xor di, cx
inc ecx
and ecx, 0x800000ff
mov word [eax + edx*2], di
jns 0x40e31e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
add esi, 2
cmp edx, 0xe
jl 0x40e303
xor ecx, ecx
pop edi
mov word [eax + 0x1c], cx
pop esi
ret 4

Function at 0x40e340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
xor edx, edx
push edi
mov ecx, 0xfa
add esi, 0x78dc1078
mov di, word [esi]
xor di, cx
inc ecx
and ecx, 0x800000ff
mov word [eax + edx*2], di
jns 0x40e36e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
add esi, 2
cmp edx, 0xe
jl 0x40e353
xor ecx, ecx
pop edi
mov word [eax + 0x1c], cx
pop esi
ret 4

Function at 0x40e430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
xor edx, edx
push edi
mov ecx, 0x96
add esi, 0xa4d9a33a
mov di, word [esi]
xor di, cx
inc ecx
and ecx, 0x800000ff
mov word [eax + edx*2], di
jns 0x40e45e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
add esi, 2
cmp edx, 0xd
jl 0x40e443
xor ecx, ecx
pop edi
mov word [eax + 0x1a], cx
pop esi
ret 4

Function at 0x40e630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
xor edx, edx
push edi
mov ecx, 0x8f
add esi, 0xb3b07a80
mov di, word [esi]
xor di, cx
inc ecx
and ecx, 0x800000ff
mov word [eax + edx*2], di
jns 0x40e65e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
add esi, 2
cmp edx, 0xc
jl 0x40e643
xor ecx, ecx
pop edi
mov word [eax + 0x18], cx
pop esi
ret 4
Function at 0x40f670
Capabilities:
Hash data using sha256

Disassembly:
push 0xffffffffffffffff
push 0x617b48
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6f7f90]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6f7f90]
xor eax, esp
push eax
lea eax, [esp + 0x1d0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1e0]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1d8], ebx
xor eax, eax
cmp dword [esp + 0x1fc], 0x10
mov ecx, 0x2a
lea esi, [esp + 0x18]
lea edi, [esp + 0xc0]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x1e8]
mov dword [esp + 0x148], 0x6a09e667
mov dword [esp + 0x14c], 0xbb67ae85
mov dword [esp + 0x150], 0x3c6ef372
mov dword [esp + 0x154], 0xa54ff53a
mov dword [esp + 0x158], 0x510e527f
mov dword [esp + 0x15c], 0x9b05688c
mov dword [esp + 0x160], 0x1f83d9ab
mov dword [esp + 0x164], 0x5be0cd19
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc0], ebx
jae 0x40f789
lea eax, [esp + 0x1e8]
push eax
mov eax, dword [esp + 0x1fc]
lea esi, [esp + 0xc4]
call fcn.0040f420
lea edi, [esp + 0x168]
call fcn.0040f4b0
mov byte [esp + 0x1c8], bl
xor esi, esi
lea edi, [esp + 0x188]
lea esp, [esp]
movzx eax, byte [esp + esi + 0x168]
push eax
push str._02x
push edi
call fcn.005e5778
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x20
jb 0x40f7c0
lea eax, [esp + 0x188]
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f7f7
sub eax, edx
push eax
lea ecx, [esp + 0x18c]
push ecx
mov ecx, ebp
call fcn.0040c5f0
cmp dword [esp + 0x1fc], 0x10
jb 0x40f82a
mov edx, dword [esp + 0x1e8]
push edx
call fcn.005c0a50
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x1d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.005e4a11
add esp, 0x1c8
ret

Function at 0x410190
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x74
mov eax, dword [0x6f7f90]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
push ebx
push esi
mov dword [esp + 8], ecx
mov byte [esp + 0xc], cl
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
push eax
mov eax, dword [esp + 0x88]
lea ecx, [esp + 0x10]
mov dword [esp + 0x5c], 0x67452301
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x98badcfe
mov dword [esp + 0x68], 0x10325476
call fcn.0040ff50
lea esi, [esp + 0xc]
call fcn.0040fff0
push edi
mov ebx, esi
call fcn.004100e0
mov ecx, dword [esp + 0x78]
pop esi
pop ebx
xor ecx, esp
mov eax, edi
call fcn.005e4a11
add esp, 0x74
ret
Function at 0x41aec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x6f7f90]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea edi, [eax + esi]
cmp eax, 8
ja 0x41af06
mov eax, 0xffffffe2
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
add esi, 8
lea eax, [ebx + 0x681c]
push eax
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [ebx + 0x2818]
push esi
push edx
call fcn.00441eb0
add esp, 0x10
cmp eax, 0xffffff88
ja 0x41aeed
add esi, eax
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x24], 0x1f
call fcn.0043f1e0
add esp, 0x14
mov dword [esp + 8], eax
cmp eax, 0xffffff88
ja 0x41aeed
mov ecx, dword [esp + 0x10]
cmp ecx, 0x1f
ja 0x41aeed
mov eax, dword [esp + 0x24]
cmp eax, 8
ja 0x41aeed
push eax
push 0x6c3270
push 0x6c31f0
push ecx
lea ecx, [esp + 0x38]
push ecx
lea edx, [ebx + 0x1008]
push edx
call fcn.00418750
add esi, dword [esp + 0x20]
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0xd8]
push eax
mov dword [esp + 0x38], 0x34
call fcn.0043f1e0
add esp, 0x2c
mov dword [esp + 8], eax
cmp eax, 0xffffff88
ja 0x41aeed
mov ecx, dword [esp + 0xc]
cmp ecx, 0x34
ja 0x41aeed
mov eax, dword [esp + 0x1c]
cmp eax, 9
ja 0x41aeed
push eax
push 0x6c2ac8
push 0x6c32f0
push ecx
lea ecx, [esp + 0xc0]
push ecx
lea edx, [ebx + 0x1810]
push edx
call fcn.00418750
add esi, dword [esp + 0x20]
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0x34], 0x23
call fcn.0043f1e0
add esp, 0x2c
mov dword [esp + 0x20], eax
cmp eax, 0xffffff88
ja 0x41aeed
mov ecx, dword [esp + 8]
cmp ecx, 0x23
ja 0x41aeed
mov eax, dword [esp + 0x14]
cmp eax, 9
ja 0x41aeed
push eax
push 0x6c29f0
push 0x6c3160
push ecx
lea ecx, [esp + 0x78]
push ecx
push ebx
call fcn.00418750
add esi, dword [esp + 0x38]
add esp, 0x18
lea edx, [esi + 0xc]
cmp edx, edi
ja 0x41aeed
sub edi, esi
sub edi, 0xc
xor ecx, ecx
lea edx, [ebx + 0x701c]
mov eax, dword [esi]
add esi, 4
test eax, eax
je 0x41aeed
cmp eax, edi
jae 0x41aeed
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 3
jl 0x41b085
mov ecx, dword [esp + 0x124]
mov eax, esi
sub eax, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
Function at 0x443f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7fc
mov eax, dword [0x6f7f90]
xor eax, esp
mov dword [esp + 0x7f4], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x40
lea eax, [esp + 0x80]
push esi
push eax
mov edi, ecx
mov dword [esp + 0x84], esi
call fcn.005e5820
add esp, 0xc
push 0x44
lea ecx, [esp + 0x38]
push esi
push ecx
mov dword [esp + 0x3c], esi
call fcn.005e5820
mov ebx, dword [edi]
add edi, 4
add esp, 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
cmp ebx, 0x10
jbe 0x443f86
mov eax, 0xffffffd4
jmp 0x44410e
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x81c]
lea ecx, [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x81c]
lea edx, [esp + 0x50c]
push edx
call fcn.004436f0
add esp, 0x10
mov dword [esp + 0x2c], eax
cmp eax, 0xffffff88
ja 0x44410e
mov edi, dword [esp + 0x1c]
cmp edi, ebx
ja 0x443f7c
mov dword [esp + 0x14], edi
cmp dword [esp + edi*4 + 0x78], esi
jne 0x443fe0
dec edi
cmp dword [esp + edi*4 + 0x78], esi
je 0x443fd5
mov dword [esp + 0x14], edi
xor ebp, ebp
lea eax, [ebp + 1]
lea ebx, [edi + 1]
mov dword [esp + 0x20], ebp
cmp ebx, eax
jbe 0x444003
mov ecx, ebp
add ebp, dword [esp + eax*4 + 0x78]
mov dword [esp + eax*4 + 0x34], ecx
inc eax
cmp eax, ebx
jb 0x443ff0
mov dword [esp + 0x20], ebp
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x34], ebp
test esi, esi
jbe 0x44403b
movzx edx, byte [esp + eax + 0x500]
mov ecx, dword [esp + edx*4 + 0x34]
mov byte [esp + ecx*2 + 0x600], al
inc eax
lea edi, [ecx + 1]
mov dword [esp + edx*4 + 0x34], edi
mov byte [esp + ecx*2 + 0x601], dl
cmp eax, esi
jb 0x444011
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub edx, dword [esp + 0x1c]
xor esi, esi
lea eax, [esi + 1]
dec edx
mov dword [esp + 0x34], esi
cmp ebx, eax
jbe 0x444072
mov ebp, dword [esp + eax*4 + 0x78]
lea ecx, [eax + edx]
shl ebp, cl
mov edi, esi
mov dword [esp + eax*4 + 0xc0], edi
inc eax
add esi, ebp
cmp eax, ebx
jb 0x444051
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov edi, dword [esp + 0x24]
inc ecx
sub edi, ecx
inc edi
cmp ecx, edi
jae 0x4440d7
mov edx, ecx
neg edx
mov eax, ecx
shl eax, 4
shl edx, 4
add eax, ecx
sub edx, ecx
lea eax, [esp + eax*4 + 0xc4]
add edx, edx
mov dword [esp + 0x18], eax
add edx, edx
cmp ebx, 1
jbe 0x4440c4
lea esi, [ebx - 1]
jmp 0x4440b0
mov ebp, dword [edx + eax]
shr ebp, cl
add eax, 4
sub esi, 1
mov dword [eax - 4], ebp
jne 0x4440b0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
inc ecx
add eax, 0x44
sub edx, 0x44
mov dword [esp + 0x18], eax
cmp ecx, edi
jb 0x4440a3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
inc ecx
push ecx
push edx
lea eax, [esp + 0xc8]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push ebp
lea edx, [esp + 0x614]
push edx
push eax
push ecx
call fcn.00447090
mov eax, dword [esp + 0x4c]
add esp, 0x20
mov ecx, dword [esp + 0x804]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005e4a11
add esp, 0x7fc
ret
Function at 0x44c100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x80]
mov ebx, dword [edi + 0x6860]
lea ecx, [esi + eax]
mov dword [esp + 0x28], ecx
lea ecx, [edx + ebp]
lea edx, [edi + 0x1004]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0x6814]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0x6818]
mov dword [esp + 0x34], edx
mov edx, dword [edi + 0x681c]
mov dword [esp + 0x30], edx
mov edx, dword [edi + 0x6858]
push edx
push eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [edi + 0x685c]
mov dword [esp + 0x20], ecx
add ebx, ecx
push esi
lea ecx, [edi + 0x1808]
push eax
push ecx
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x98]
call fcn.0044b960
add esp, 0x18
cmp eax, 0xffffff88
ja 0x44c311
cmp dword [esp + 0x80], 0
lea edx, [eax + esi]
je 0x44c2d5
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x74], eax
add eax, ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x28]
mov esi, 1
sub eax, edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], esi
mov dword [esp + 0x70], esi
call fcn.004496f0
cmp eax, 0xffffff88
jbe 0x44c1f5
mov eax, 0xffffffec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
lea edx, [esp + 0x58]
push edx
mov eax, edi
lea edx, [esp + 0x4c]
call fcn.00449810
lea eax, [esp + 0x64]
add esp, 4
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x4c]
call fcn.00449810
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x6c]
add esp, 4
push ecx
lea edx, [esp + 0x4c]
call fcn.00449810
add esp, 4
lea ecx, [esp + 0x48]
call fcn.00443070
cmp eax, 2
jg 0x44c2c7
jmp 0x44c255
mov esi, 1
cmp dword [esp + 0x80], 0
je 0x44c2d5
sub dword [esp + 0x80], esi
lea edx, [esp + 0x3c]
push edx
lea esi, [esp + 0x4c]
call fcn.0044bd40
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 4
push eax
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x4c]
push ebx
lea eax, [esp + 0x28]
push eax
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
push edx
mov eax, ebp
call fcn.0044bf40
add esp, 0x24
cmp eax, 0xffffff88
ja 0x44c311
mov ecx, esi
add ebp, eax
call fcn.00443070
cmp eax, 2
jle 0x44c250
cmp dword [esp + 0x80], 0
jne 0x44c1e8
mov eax, dword [esp + 0x18]
mov esi, ebx
sub esi, eax
cmp eax, ebx
ja 0x44c1e8
lea ecx, [esi + ebp]
cmp ecx, dword [esp + 0x1c]
jbe 0x44c2fb
mov eax, 0xffffffba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
push esi
push eax
push ebp
call fcn.005e4a20
mov eax, esi
sub eax, dword [esp + 0x90]
add esp, 0xc
add eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x44fce0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
xor ebp, ebp
cmp ebx, ebp
jne 0x44fcf1
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x10]
push esi
push 0x54
cmp eax, ebp
je 0x44fd13
mov ecx, dword [esp + 0x20]
push ecx
call eax
push 0x54
mov esi, eax
push ebp
push esi
call fcn.005e5820
add esp, 0x14
jmp 0x44fd1f
push 1
call fcn.005edd36
add esp, 8
mov esi, eax
cmp esi, ebp
jne 0x44fd29
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push edi
mov edi, 1
mov dword [esi + 0x24], edi
mov eax, dword [esp + 0x18]
push 8
cmp eax, ebp
je 0x44fd48
mov edx, dword [esp + 0x24]
push edx
call eax
add esp, 8
jmp 0x44fd50
call fcn.005e6b8f
add esp, 4
mov dword [esi + 0x18], eax
lea eax, [esi + 0x30]
push eax
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea ecx, [esi + 0x48]
push ecx
call edi
lea edx, [esi + 0x4c]
push edx
call edi
lea eax, [ebx + ebx*2]
add eax, eax
mov dword [esi + 0x50], ebp
mov ecx, dword [esp + 0x18]
add eax, eax
push eax
cmp ecx, ebp
je 0x44fd9a
mov eax, dword [esp + 0x24]
push eax
call ecx
add esp, 8
jmp 0x44fda2
call fcn.005e6b8f
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebp
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov edx, dword [esp + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [esp + 0x20]
mov dword [esi + 8], ecx
cmp eax, ebp
je 0x44fe23
cmp dword [esi + 0x18], ebp
je 0x44fe23
cmp ebx, ebp
jbe 0x44fe13
xor ebx, ebx
jmp 0x44fdd0
mov edi, dword [esi + 0xc]
push 0
push 0
add edi, ebx
push edi
push 0x450b60
push 0
push 0
mov dword [edi + 8], esi
mov dword [edi + 4], 0x44fc10
call fcn.005e5a5a
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x44fe05
call fcn.005eb8db
cmp dword [eax], 0
jne 0x44fe20
inc ebp
add ebx, 0xc
cmp ebp, dword [esp + 0x14]
jb 0x44fdd0
mov ebx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x10], ebp
mov eax, esi
call fcn.0044fed0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret