joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436660
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d42c6
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x848]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x3c]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x43673c
lea edi, [esp + 0x3c]
xor esi, esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x850], esi
cmp ebx, 0x3fe
jbe 0x436762
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ad321
add esp, 4
mov edi, eax
mov esi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x38], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x436724
cmp eax, ebx
ja 0x436724
xor ecx, ecx
mov ebx, eax
mov dword [edi + eax*2], ecx
mov dword [esp + 0x14], ebx
jmp 0x43678a
mov dword [esp + 0x850], 0xffffffff
test edi, edi
je 0x43673c
push edi
call fcn.004b1ec2
add esp, 4
xor al, al
mov ecx, dword [esp + 0x848]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.004b0ff2
mov esp, ebp
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x436836
xor ecx, ecx
mov word [esp + eax + 0x3c], cx
add eax, 2
cmp eax, 0x800
jae 0x436836
mov word [esp + eax + 0x3c], cx
xor ecx, ecx
xor edi, edi
test ebx, ebx
je 0x436817
mov esi, dword [esp + 0x18]
mov ebx, 2
mov eax, dword [esp + 0x14]
cmp word [esi + ebx - 2], 0
jne 0x43680b
cmp ecx, edi
je 0x43680b
lea eax, [esi + ecx*2]
push eax
lea ecx, [esp + 0x24]
call fcn.00402470
mov byte [esp + 0x850], 1
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
call fcn.0040ea80
mov byte [esp + 0x850], 0
cmp dword [esp + 0x34], 8
jb 0x4367ed
push dword [esp + 0x20]
call fcn.004b17b6
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov word [esp + 0x20], ax
lea ecx, [edi + 1]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], 0
inc edi
add ebx, 2
cmp edi, eax
jb 0x4367a3
mov esi, dword [esp + 0x38]
mov dword [esp + 0x850], 0xffffffff
test esi, esi
je 0x43682f
push esi
call fcn.004b1ec2
add esp, 4
mov al, 1
jmp 0x43673e
call fcn.004b1d93
int3
Function at 0x436840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
lea esp, [esp]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x50f9f0], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x50faf0], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x50fbf0], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x50f8f0], al
inc esi
cmp esi, 0x100
jl 0x436950
pop esi
add esp, 0x80
ret
Function at 0x437fa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4fc750
push 0x4b9bd0
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x50c620]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00406060
mov edx, esi
mov ecx, edi
call fcn.00438100
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x438035
test bl, bl
jne 0x4380dd
cmp edi, 0x1a
jne 0x4380dd
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x438057
mov eax, dword [esi]
jmp 0x438059
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x430], ax
push 0x40e
push eax
lea eax, [ebp - 0x42e]
push eax
call fcn.004b5340
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [ebp - 0x430], 0
jne 0x4380a1
xor ecx, ecx
jmp 0x4380bf
lea ecx, [ebp - 0x430]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4380b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00402ad0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004b0ff2
mov esp, ebp
pop ebp
ret

Function at 0x43a310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d4658
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], 0
sub ecx, edi
mov eax, 0xdd67c8a7
imul ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], 0
add edx, ecx
mov dword [esp + 0x14], 0
sar edx, 7
mov esi, edx
mov dword [esp + 0x18], 0
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov ecx, edi
push dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push esi
call fcn.0043a630
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x10]
test esi, esi
je 0x43a3f0
cmp esi, dword [esp + 0x18]
je 0x43a3e7
mov edi, edi
mov ecx, esi
call fcn.0043aee0
add esi, 0x94
cmp esi, dword [esp + 0x18]
jne 0x43a3d0
mov esi, dword [esp + 0x10]
push esi
call fcn.004b17b6
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004b0ff2
add esp, 0x28
ret
Function at 0x43c470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d49b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x43c640
test esi, esi
je 0x43c640
cmp ebx, esi
jg 0x43c571
mov ecx, edi
call fcn.0043b030
cmp ebx, eax
jg 0x43c571
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 0
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x58], 0xffffffff
mov edx, ebp
lea ecx, [esp + 0x3c]
call fcn.0043c270
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.0043a600
push dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov ecx, esi
push ebp
mov edx, ebx
call fcn.0043a010
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.0043d4c0
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, edi
call fcn.0043b030
cmp esi, eax
jg 0x43c619
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 1
mov ebx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x3c]
mov edx, dword [esp + 0x34]
call fcn.0043c270
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.0043a600
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, ebp
push ebx
call fcn.0043d4c0
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebp
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.0043a010
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov edx, dword [esp + 0x1c]
push ebx
call fcn.0043cdb0
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
imul eax, esi, 0x94
add eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x43c8c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4d4a0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.004029b0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x64]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 4
lea ecx, [edi + 0x7c]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x7c]
push eax
call fcn.004029b0
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x43ca00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4d4a69
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
cmp esi, ebp
je 0x43ca87
cmp edi, ebx
je 0x43ca87
push esi
mov ecx, edi
call fcn.0043ded0
lea ecx, [esp + 0x54]
test al, al
je 0x43ca77
push edi
call fcn.0043d410
add edi, 0x94
cmp edi, ebx
jmp 0x43ca85
push esi
call fcn.0043d410
add esi, 0x94
cmp esi, ebp
jne 0x43ca57
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 2
push ebp
mov byte [esp + 0x58], 1
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.0043c270
add esp, 0x18
mov byte [esp + 0x40], 3
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], eax
mov byte [esp + 0x40], 1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x43cb10
cmp esi, dword [esp + 0x2c]
je 0x43cb07
lea ebx, [ebx]
mov ecx, esi
call fcn.0043aee0
add esi, 0x94
cmp esi, dword [esp + 0x2c]
jne 0x43caf0
mov esi, dword [esp + 0x24]
push esi
call fcn.004b17b6
add esp, 4
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 4
push ebx
mov byte [esp + 0x58], 1
mov edx, edi
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.0043c270
add esp, 0x18
mov dword [esp + 0x14], 1
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0x54]
test esi, esi
je 0x43cb91
cmp esi, dword [esp + 0x5c]
je 0x43cb88
mov ecx, esi
call fcn.0043aee0
add esi, 0x94
cmp esi, dword [esp + 0x5c]
jne 0x43cb71
mov esi, dword [esp + 0x54]
push esi
call fcn.004b17b6
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x43d280
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4d4633
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.004029b0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 1
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov ax, word [esi + 0x34]
mov word [edi + 0x34], ax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x43d330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d4b69
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.004029b0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.004029b0
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x43d7b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d4c3f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [esp + 0x14], eax
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], eax
mov word [esi + 0x18], ax
mov byte [esp + 0x14], 1
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], eax
mov word [esi + 0x30], ax
mov byte [esp + 0x14], 2
mov dword [esi + 0x5c], 7
mov dword [esi + 0x58], eax
mov word [esi + 0x48], ax
mov byte [esp + 0x14], 3
mov dword [esi + 0x74], 7
mov dword [esi + 0x70], eax
mov word [esi + 0x60], ax
mov byte [esp + 0x14], 4
mov dword [esi + 0x8c], 7
mov dword [esi + 0x88], eax
mov word [esi + 0x78], ax
mov byte [esp + 0x14], 5
push 0x35c
push eax
lea eax, [esi + 0x98]
push eax
call fcn.004b5340
add esp, 0xc
xor eax, eax
mov dword [esi + 0x90], eax
mov word [esi + 0x94], ax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x43e1f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d4df9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
call fcn.0043dfc0
add esp, 4
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.0043e080
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], 1
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004b0ff2
add esp, 0x28
ret
Function at 0x440a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d5318
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
lea esi, [edi + 0x58]
mov dword [esp + 0xc], 0x400
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], esi
test esi, esi
je 0x440a82
mov eax, dword [esi]
test eax, eax
je 0x440a82
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x28], 0
lea eax, [esp + 0xc]
push eax
lea ecx, [edi + 0x5c]
call fcn.00441eb0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x440aa5
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esp + 0x28], 0xffffffff
test esi, esi
je 0x440ac6
mov eax, dword [esi]
test eax, eax
je 0x440abe
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004b0ff2
add esp, 0x20
ret 4
Function at 0x440c70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d5398
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ebx, [esi + 0xc]
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x440cc5
mov eax, dword [ebx]
test eax, eax
je 0x440cc5
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
push esi
lea ecx, [esp + 0x20]
movq qword [esp + 0x20], xmm0
mov dword [esp + 0x28], 0
call fcn.00441d20
mov byte [esp + 0x38], 1
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x440d06
mov eax, dword [ebx]
test eax, eax
je 0x440d00
push eax
call esi
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x1c]
mov edi, eax
cmp eax, dword [esp + 0x20]
je 0x440de4
mov ebx, dword [esp + 0x10]
lea ebx, [ebx]
lea esi, [ebx + 0xc]
mov dword [esp + 0x18], esi
test esi, esi
je 0x440d38
mov eax, dword [esi]
test eax, eax
je 0x440d38
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x440dab
mov edx, dword [eax]
mov dword [esp + 0x10], edx
test edx, edx
je 0x440d54
cmp edx, dword [edi]
je 0x440d5d
add eax, 0x18
cmp eax, ecx
jne 0x440d46
jmp 0x440dab
push eax
call fcn.00441260
test al, al
je 0x440d8b
test esi, esi
je 0x440d7e
mov eax, dword [esi]
test eax, eax
je 0x440d78
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov dword [esp + 0x18], esi
push dword [esp + 0x10]
mov ecx, ebx
call fcn.004416a0
jmp 0x440dab
test esi, esi
je 0x440da2
mov eax, dword [esi]
test eax, eax
je 0x440d9c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x10]
call fcn.00425830
mov byte [esp + 0x38], 1
test esi, esi
je 0x440dc9
mov eax, dword [esi]
test eax, eax
je 0x440dc1
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x18], 0
add edi, 0x18
cmp edi, dword [esp + 0x20]
jne 0x440d20
mov ebx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x38], 0
test eax, eax
je 0x440e0e
push eax
call fcn.004b17b6
add esp, 4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], 0xffffffff
test ebx, ebx
je 0x440e2b
mov eax, dword [ebx]
test eax, eax
je 0x440e23
push eax
call esi
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004b0ff2
mov esp, ebp
pop ebp
ret