joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4212c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59572f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
call fcn.00582d50
xor edi, edi
lea ecx, [esi + 0x68]
mov dword [ebp - 4], edi
mov dword [esi], 0x5b2fd0
call fcn.0040a2c0
lea ecx, [esi + 0x95c]
mov byte [ebp - 4], 1
call fcn.004211c0
lea ecx, [esi + 0x964]
mov byte [ebp - 4], 2
call fcn.00420b60
push edi
mov ecx, esi
mov dword [esi + 0x5c], 0x80
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], 0x104
mov byte [ebp - 4], 4
call fcn.00582e30
cmp eax, edi
je 0x42138d
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edi
push 0x20006
push edi
push 0x5ae5e8
push edi
push str.EUDC932
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x42138d
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push edx
push 0x11c6a30
push edi
push edi
push str.SystemDefaultEUDCFont
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
mov ecx, esi
call fcn.00582e30
jmp 0x4213a3
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x954], edi
mov dword [esi + 0x958], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421ec0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
test esi, esi
je 0x421f23
cmp dword [0x11c8168], 1
jne 0x421ee7
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
pop edi
pop esi
add esp, 0x10
ret 4
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
je 0x421f23
mov edx, dword [eax + 4]
lea ecx, [esp + 8]
push ecx
push edx
call fcn.0056cd00
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
mov ecx, dword [esp + 8]
sub edx, ecx
mov ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esp + 0xc]
sub ecx, edx
pop edi
mov dword [esi + 4], ecx
pop esi
add esp, 0x10
ret 4
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x424520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x595a90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00455510
lea ecx, [esp + 0x24]
mov dword [esp + 0x60], 0
call fcn.0045f770
push 0
mov ecx, esi
mov byte [esp + 0x64], 1
call fcn.00423b60
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.00460440
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
push ecx
push edx
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x78]
call fcn.00458110
lea ecx, [esp + 0x24]
mov esi, eax
mov byte [esp + 0x60], 0
call fcn.0045f7e0
lea ecx, [esp + 4]
mov dword [esp + 0x60], 0xffffffff
call fcn.00455530
mov ecx, dword [esp + 0x58]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x10
Function at 0x4256a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x595ac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
call fcn.00459e30
mov eax, dword [esp + 0x44]
test eax, eax
mov esi, dword [esp + 0x38]
mov dword [esp + 0x30], 0
jne 0x4256e0
mov ecx, esi
call fcn.00424820
lea ecx, [esp + 8]
call fcn.00424820
lea eax, [esp + 8]
push eax
mov ecx, edi
call fcn.00424400
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push 1
push ecx
push edx
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00458110
mov esi, dword [esi + 0xc]
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.00459e50
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10

Function at 0x425770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x595ac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
call fcn.00459e30
mov eax, dword [esp + 0x4c]
test eax, eax
mov esi, dword [esp + 0x40]
mov dword [esp + 0x38], 0
jne 0x4257b2
mov ecx, esi
call fcn.00424820
lea ecx, [esp + 0x10]
call fcn.00424820
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00424400
mov ebx, dword [esp + 0x48]
mov ebp, dword [esp + 0x44]
push 1
push ebx
push ebp
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00458110
lea ecx, [esp + 0x10]
call fcn.00424820
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00424680
push 1
push ebx
push ebp
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00458110
lea ecx, [esp + 0x10]
call fcn.00424820
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.004246b0
push 1
push ebx
push ebp
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00458110
mov esi, dword [esi + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.00459e50
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10

Function at 0x425e20
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x595ac8
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov edi, dword [esp + 0x38]
push edi
mov esi, ecx
call fcn.00404810
add esp, 4
test eax, eax
je 0x425ea0
lea ecx, [esp + 8]
call fcn.00459e30
push 0
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00425740
push edi
lea ecx, [esp + 0xc]
call fcn.00457770
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00459e50
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov ecx, dword [esp + 0x28]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x429510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x595cb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004562c0
lea ecx, [esp + 0x24]
mov dword [esp + 0x60], 0
call fcn.0045fa60
push 0
mov ecx, esi
mov byte [esp + 0x64], 1
call fcn.00434030
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.00460440
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
push ecx
push edx
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x78]
call fcn.00458110
lea ecx, [esp + 0x24]
mov esi, eax
mov byte [esp + 0x60], 0
call fcn.0045fac0
lea ecx, [esp + 4]
mov dword [esp + 0x60], 0xffffffff
call fcn.004562e0
mov ecx, dword [esp + 0x58]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x10

Function at 0x42c580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x595e00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
mov esi, ecx
lea ecx, [esp + 0x30]
call fcn.00459e30
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], 0
call fcn.00459e30
push 1
push 3
lea ecx, [esp + 0xc]
mov byte [esp + 0x60], 1
call fcn.00456a00
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0042c120
push 0
lea ecx, [esp + 8]
push ecx
push 0x459ea0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x40]
call fcn.00458110
xor ecx, ecx
cmp eax, 1
setg cl
mov byte [esp + 0x58], 0
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.00459e50
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], 0xffffffff
call fcn.00459e50
mov ecx, dword [esp + 0x50]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x58
ret

Function at 0x42e54a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x595db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x3c]
push edi
call fcn.00424820
lea ecx, [esp + 0x10]
call fcn.00459e30
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.0042da30
push 0
call fcn.0043f400
add esp, 4
mov ebx, eax
mov ebp, 0x1f
lea esp, [esp]
push ebx
call fcn.00404810
add esp, 4
test eax, eax
je 0x42e5f6
mov ecx, ebx
call fcn.00434770
test eax, eax
je 0x42e5f6
mov edi, dword [esp + 0x14]
test edi, edi
je 0x42e5f6
mov eax, edi
mov esi, dword [eax + 8]
test esi, esi
mov edi, dword [edi]
je 0x42e5da
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10]
test eax, eax
je 0x42e5da
push 0x5b3d3c
mov ecx, esi
call fcn.00591e20
test eax, eax
je 0x42e5da
mov ecx, esi
jmp 0x42e5dc
xor ecx, ecx
push ebx
call fcn.0043a900
test eax, eax
jne 0x42e5ec
test edi, edi
jne 0x42e5b0
jmp 0x42e5f6
mov ecx, dword [esp + 0x40]
push ebx
call fcn.00457d50
add ebx, 0x8c
dec ebp
jne 0x42e590
mov eax, dword [esp + 0x40]
mov esi, dword [eax + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.00459e50
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x437ba0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x596200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
mov eax, dword [esp + 0x74]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push esi
lea eax, [esp + 4]
push edi
push eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004373b0
mov ecx, dword [0x11c76a8]
imul ecx, dword [esp + 0x10]
add ecx, dword [esp + 0xc]
push ecx
call fcn.0043f070
mov esi, eax
mov eax, dword [esp + 0x88]
mov edx, dword [eax]
mov eax, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.004373b0
mov edx, dword [0x11c76a8]
imul edx, dword [esp + 0x18]
add edx, dword [esp + 0x14]
push edx
call fcn.0043f070
add esp, 0x10
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0045c540
push edi
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x7c], 0
call fcn.00463470
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], 1
call fcn.004613b0
push esi
lea ecx, [esp + 0x14]
call fcn.00457770
test eax, eax
je 0x437c6b
push esi
lea ecx, [esp + 0x14]
call fcn.00457c00
push edi
lea ecx, [esp + 0x14]
call fcn.00457770
test eax, eax
je 0x437c83
push edi
lea ecx, [esp + 0x14]
call fcn.00457c00
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00437b20
add esp, 0xc
lea ecx, [esp + 0x30]
mov esi, eax
mov byte [esp + 0x74], 0
call fcn.00463020
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045c560
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret

Function at 0x43f7f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x596398
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov edi, dword [esp + 0x40]
push edi
call fcn.0043ef10
mov esi, eax
push esi
call fcn.00404810
add esp, 8
test eax, eax
je 0x43f849
add esi, 0xd4
inc edi
cmp edi, 0x32
jge 0x43f849
nop
push esi
call fcn.00404810
add esp, 4
test eax, eax
je 0x43f849
inc edi
add esi, 0xd4
cmp edi, 0x32
jl 0x43f830
push esi
call fcn.00404810
add esp, 4
test eax, eax
jne 0x43f8bb
mov edi, dword [esp + 0x3c]
push edi
call fcn.00404810
add esp, 4
test eax, eax
je 0x43f8bb
test esi, esi
je 0x43f8bb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
lea ecx, [esp + 8]
call fcn.00459e30
mov edx, dword [esp + 0x38]
push edi
lea ecx, [esp + 0xc]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.004320f0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00459e50
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x28]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x43fe00
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x43fe9e
push ebp
push esi
push edi
push ebx
call dword [sym.imp.MyDoc.dll_void___cdecl_GetMyDocumentPath_char__]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 4
push 0
push ebx
call ebp
push ebx
call fcn.00433e20
mov eax, dword [str.Koei]
add esp, 4
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43fe35
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43fe41
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call ebp
push ebx
call fcn.00433e20
mov eax, dword [str.San9_TC]
add esp, 4
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43fe70
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43fe80
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43fea0
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x43fef3
push ebx
call fcn.0043fe00
push ebx
call fcn.00433e20
mov eax, dword [esp + 0x14]
add esp, 8
mov edx, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43fec0
push esi
push edi
mov edi, ebx
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43fed0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
ret

Function at 0x441740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebp
push edi
lea ecx, [esp + 8]
call fcn.00459e30
lea ecx, [esp + 8]
mov dword [esp + 0x5c], 0
call fcn.00424820
lea ecx, [esp + 8]
call fcn.00458010
push 0x542d20
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.00542990
push 0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0x64], 1
call fcn.00542fa0
mov edi, dword [esp + 0xc]
xor ebp, ebp
test edi, edi
je 0x4417f3
push esi
mov eax, edi
mov esi, dword [eax + 8]
test esi, esi
mov edi, dword [edi]
je 0x4417d6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10]
test eax, eax
je 0x4417d6
push 0x5b3d3c
mov ecx, esi
call fcn.00591e20
test eax, eax
jne 0x4417d8
xor esi, esi
push esi
call fcn.00404810
add esp, 4
test eax, eax
je 0x4417ed
push ebp
mov ecx, esi
call fcn.00438d30
inc ebp
test edi, edi
jne 0x4417b0
pop esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x5c], 0
call fcn.005427f0
lea ecx, [esp + 8]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00459e50
mov ecx, dword [esp + 0x54]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x58
ret
Function at 0x443a00
Capabilities:
Get disk information

Disassembly:
mov al, byte [esp + 4]
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
cmp al, 0x41
push edi
jl 0x44024c
cmp al, 0x5a
jg 0x44024c
movsx esi, al
sub esi, 0x41
jmp 0x44025a
cmp al, 0x61
jl 0x4402cf
cmp al, 0x7a
jg 0x4402cf
movsx esi, al
sub esi, 0x61
cmp esi, 0x1a
jae 0x4402cf
call sub.KERNEL32.dll_GetLogicalDrives
mov edx, 1
mov ecx, esi
shl edx, cl
test edx, eax
je 0x4402cf
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
inc esi
push esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
call fcn.00588419
add esp, 8
test eax, eax
jne 0x4402cf
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov ecx, esi
imul ecx, edi
cmp ecx, ebx
jbe 0x4402cf
or eax, 0xffffffff
xor edx, edx
div ecx
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jae 0x4402c5
imul ecx, esi
imul ecx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x10
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
je 0x443a23
cmp byte [ecx + 1], 0x3a
jne 0x443a23
cmp byte [ecx + 2], 0x5c
jne 0x443a23
xor eax, eax
mov al, byte [ecx]
mov dword [esp + 4], eax
jmp 0x440230
ret

Function at 0x443a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
lea ecx, [esp + 8]
xor ebx, ebx
call fcn.00456ac0
lea ecx, [esp + 8]
mov dword [esp + 0x30], ebx
call fcn.00458010
mov edi, dword [esp + 0xc]
test edi, edi
je 0x443ab4
push esi
jmp 0x443a70
mov eax, edi
mov esi, dword [eax + 8]
test esi, esi
mov edi, dword [edi]
je 0x443a96
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x443a96
push 0x5b390c
mov ecx, esi
call fcn.00591e20
test eax, eax
jne 0x443a98
xor esi, esi
mov ecx, esi
call fcn.0042c460
test eax, eax
je 0x443aaf
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x40]
test eax, eax
je 0x443aaf
inc ebx
test edi, edi
jne 0x443a70
pop esi
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.00456ae0
mov ecx, dword [esp + 0x28]
pop edi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x44cda0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5966b8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push ebp
mov ebx, ecx
call fcn.00404810
add esp, 4
test eax, eax
je 0x44cf30
push esi
mov esi, dword [ebx + 0x84]
test esi, esi
push edi
je 0x44ce1e
lea ecx, [ecx]
mov eax, esi
mov edi, dword [eax + 8]
test edi, edi
mov esi, dword [esi]
je 0x44ce06
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x44ce06
push 0x5b3d3c
mov ecx, edi
call fcn.00591e20
test eax, eax
jne 0x44ce08
xor edi, edi
push 0
mov ecx, edi
call fcn.004dabf0
push 9
mov ecx, edi
call fcn.004394a0
test esi, esi
jne 0x44cde0
lea ecx, [esp + 0x10]
call fcn.0041c440
lea ecx, [esp + 0x18]
call fcn.0041c440
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x44ce46
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.0044ba10
jmp 0x44ce5c
mov eax, dword [ebx]
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call dword [eax + 0xb8]
mov ecx, eax
call fcn.00446440
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.004381f0
mov edi, dword [ebx + 0x44]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00437a20
mov esi, eax
push esi
call fcn.00410a70
add esp, 0xc
mov ecx, ebx
mov ebp, eax
call fcn.0044b6d0
cmp eax, 0x17
je 0x44ceae
cmp eax, 0x20
jle 0x44ce9d
cmp eax, 0x24
jle 0x44ceae
cmp esi, edi
jl 0x44cecb
push edi
push esi
call dword [sym.imp.SanCalc.dll_int___cdecl_limsub_int__int_]
add esp, 8
jmp 0x44cec9
cmp ebp, edi
jl 0x44cecb
mov ecx, ebp
sub ecx, esi
push ecx
push edi
call dword [sym.imp.SanCalc.dll_int___cdecl_max_int__int_]
push eax
push ebp
call dword [sym.imp.SanCalc.dll_int___cdecl_limsub_int__int_]
add esp, 0x10
mov esi, eax
push esi
mov ecx, ebx
call fcn.004479f0
call fcn.00448a10
mov edx, dword [esp + 0x48]
mov edi, eax
mov esi, edi
push edx
lea ecx, [esp + 0x24]
shr esi, 0x14
call fcn.00453fb0
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x44], 0
call fcn.0044b850
cmp esi, 7
je 0x44cf15
cmp esi, 0x64
je 0x44cf15
cmp esi, 0x65
je 0x44cf15
cmp esi, 0x66
jne 0x44cf1d
push edi
mov ecx, ebx
call fcn.004479a0
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], 0xffffffff
call fcn.00454520
pop edi
pop esi
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8
Function at 0x45b1a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00455510
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.00457d50
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0045b170
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00455530
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc

Function at 0x45b468
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596fc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00456ac0
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.00457d50
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0045b420
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00456ae0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc

Function at 0x45b890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596fc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00456ac0
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.00457d50
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0045b860
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00456ae0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc

Function at 0x45b8a8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596fc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00456ac0
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.00457d50
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0045b860
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.00456ae0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x45b910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596ff0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
mov esi, ecx
lea ecx, [esp + 0x40]
call fcn.00459e30
mov eax, dword [esp + 0x70]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x6c], 0
call fcn.0045c140
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x45a6f0
lea ecx, [esp + 0x4c]
call fcn.00458060
lea ecx, [esp + 0x20]
call fcn.00459e30
push 1
push 0xe
lea ecx, [esp + 0xc]
mov byte [esp + 0x70], 1
call fcn.00456a00
push 0
lea edx, [esp + 8]
push edx
push 0x459ea0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x30]
call fcn.00458110
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00458110
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x68], 0
call fcn.00459e50
lea ecx, [esp + 0x40]
mov dword [esp + 0x68], 0xffffffff
call fcn.00459e50
mov ecx, dword [esp + 0x60]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x68
ret 0x10