joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd9ee
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5557a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004e0abe
mov dword [ebp - 0x14], eax
cmp dword [0x560b08], esi
jne 0x4fdae1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4fda6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4fdbc1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4fdbc1
push 0x531f30
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4fdbc1
push eax
call ebx
push 0x531f3c
push edi
mov dword [0x560b08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x560b0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x560b10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x560b18], eax
test eax, eax
je 0x4fdade
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x560b14], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4fdb06
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4fdaf9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4fdb1b
push 4
pop eax
jmp 0x4fdbc3
cmp dword [ebp - 0x14], esi
je 0x4fdb1b
push dword [0x560b08]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4fdb00
mov eax, dword [0x560b14]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4fdb79
cmp dword [0x560b18], edi
je 0x4fdb79
push eax
call ebx
push dword [0x560b18]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4fdb79
test eax, eax
je 0x4fdb79
call ecx
test eax, eax
je 0x4fdb6e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4fdb6e
test byte [ebp - 8], 1
jne 0x4fdb79
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4fdba9
mov eax, dword [0x560b0c]
cmp eax, edi
je 0x4fdba6
push eax
call ebx
test eax, eax
je 0x4fdba6
call eax
mov esi, eax
test esi, esi
je 0x4fdba6
mov eax, dword [0x560b10]
cmp eax, edi
je 0x4fdba6
push eax
call ebx
test eax, eax
je 0x4fdba6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x560b08]
call ebx
test eax, eax
je 0x4fdbc1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4fdbc3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d11d6
mov esp, ebp
pop ebp
ret
Function at 0x100010ba
Capabilities:
Allocate or change rwx memory

Disassembly:
mov byte [esp + 4], ah
mov dword [ebp + 4], eax
call fcn.10074ac9
mov edi, 0xc35de58b
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0x80000005
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x100010ed
mov eax, 0x10009420
push eax
push 1
mov ebx, 0x194
call fcn.10004700
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.10004710
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10001136
push ebx
call fcn.10004267
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x400
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10001174
push 0x68
push 0x40100af
push 6
call fcn.10004273
add esp, 0xc
lea eax, [ebp - 8]
push eax
call fcn.1000125e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp + 8]
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x100011b2
push 0xa9
push 0x40100af
push 6
call fcn.10004273
add esp, 0xc
push dword [ebp + 0xc]
call fcn.1000125e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x100011ef
push 0xeb
push 0x40100af
push 6
call fcn.10004273
add esp, 0xc
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0x400
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10001227
push 0x10d
push 0x40100af
push 6
call fcn.10004273
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x10001241
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.1000427f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10001246
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10001257
push ebx
call fcn.10004267
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10002792
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000005
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x100027b7
mov eax, 0x10009420
push eax
push 1
mov ebx, 0x194
call fcn.10004700
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000280b
push 0x3b
push 0x4017b5c
push 6
call fcn.10004273
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002822
mov eax, 0
jmp 0x100028b0
push 0x80000005
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x10002837
mov eax, 0x10009420
push eax
push 1
mov ebx, 0x194
call fcn.10004700
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x10002864
add eax, 8
push eax
push dword [ebp - 4]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002891
push 0x158
push 0x4017b5c
push 6
call fcn.10004273
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100028a8
mov eax, 0
jmp 0x100028b0
mov eax, dword [ebp - 4]
jmp 0x100028b0
mov esp, ebp
pop ebp
ret 8
Function at 0x420e30
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.RsInit.cfg
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x420e78
lea eax, [esp + 4]
push 0
push eax
push 0x230
push str.APINI
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.RsInit.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x420eb2
push str.GetInitialData
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420eab
push str.APINI
call eax
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ecx
ret

Function at 0x421210
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x4a2ba8]
sub esp, 0x108
add eax, 0x39
lea ecx, [esp + 4]
push esi
push edi
push eax
push 0x4a2bac
push str._s_s.dat
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
lea eax, [esp + 8]
push 0
push eax
push 0x872
push 0x4853c0
push esi
call edi
mov edx, dword [0x4853b0]
lea ecx, [esp + 8]
push 0
push ecx
add edx, 0x36b0
push 0x1770
push edx
push esi
call edi
mov ecx, dword [0x4852f8]
push esi
call fcn.00433230
mov ecx, dword [0x4852fc]
push esi
call fcn.00433230
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x108
ret

Function at 0x4212c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x4a2ba8]
sub esp, 0x108
add eax, 0x39
lea ecx, [esp + 4]
push esi
push eax
push 0x4a2bac
push str._s_s.dat
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 8]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x421325
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00420ec0
call fcn.00421210
pop esi
add esp, 0x108
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 8]
push 0
push eax
push 0x872
push 0x4853c0
push esi
call edi
mov edx, dword [0x4853b0]
lea ecx, [esp + 8]
push 0
push ecx
add edx, 0x36b0
push 0x1770
push edx
push esi
call edi
mov ecx, dword [0x4852f8]
push esi
call fcn.00432fe0
mov ecx, dword [0x4852fc]
push esi
call fcn.00432fe0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x108
ret
Function at 0x421660
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x4a2ba8]
sub esp, 0x108
and eax, 0xffff
add ecx, 0x39
lea edx, [esp + 4]
push esi
push eax
push ecx
push 0x4a2bac
push str._s_s_02d.dat
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 8]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4216c8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x108
ret
mov eax, dword [esp + 0x114]
test eax, eax
je 0x4216e4
lea ecx, [esp + 4]
push 0
push ecx
push 0x68
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x108
ret
Function at 0x433230
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x1c]
push 4
push edx
push esi
mov dword [esp + 0x28], eax
call edi
test eax, eax
jne 0x433267
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [esp + 0xc], eax
je 0x4332d5
mov cx, word [eax + 0xc]
push 0
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0x10]
lea ecx, [esp + 0x24]
mov eax, dword [edx + 4]
push ecx
lea edx, [esp + 0x20]
push 2
push edx
push esi
mov dword [esp + 0x24], eax
call edi
lea eax, [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call edi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push 0
push edx
mov edx, dword [ecx + 0x10]
push eax
mov eax, dword [edx]
push eax
push esi
call edi
lea ecx, [esp + 0xc]
call fcn.00433f00
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 4]
cmp eax, ecx
jne 0x433274
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 4

Function at 0x434ce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x47363c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov dword [esp + 0x18], ebx
mov dword [ebx], 0x478ae0
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
mov dword [esp + 0x24], 4
call dword [eax + 0xc]
mov eax, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x30]
lea edi, [ebx + 0x2c]
push eax
push ecx
mov ecx, edi
call fcn.00434f70
mov eax, dword [ebx + 0x40]
lea ebp, [ebx + 0x3c]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.00470c40
mov edx, dword [eax]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, ebp
call fcn.00434fb0
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
lea esi, [ebx + 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.00435090
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
cmp ecx, eax
mov byte [esp + 0x24], 3
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x434d96
jmp 0x434d7c
mov ecx, dword [esp + 0x10]
push 0
call fcn.00435340
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add eax, 0x10
cmp eax, ecx
mov dword [esp + 0x10], eax
jne 0x434d78
mov eax, dword [esi + 4]
push eax
call fcn.00463110
xor eax, eax
add esp, 4
mov ecx, ebp
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov byte [esp + 0x24], 2
call fcn.00434e20
mov eax, dword [edi + 4]
push eax
mov dword [esp + 0x18], eax
call fcn.00463110
xor ebp, ebp
lea esi, [ebx + 4]
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
add esp, 4
mov dword [esp + 0x14], esi
mov dword [esi], 0x477b18
mov ecx, dword [esi + 4]
mov byte [esp + 0x24], 5
cmp ecx, ebp
je 0x434df6
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 4], ebp
mov ecx, dword [esp + 0x1c]
mov dword [esi], 0x477b40
pop edi
pop esi
mov dword [ebx], 0x476598
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x436c00
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 0
push eax
push 0x10
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x436c20
pop edi
ret
push ebx
push ebp
push esi
mov esi, dword [edi + 0xc]
imul esi, dword [edi + 8]
shl esi, 1
push esi
call fcn.00463c77
push esi
mov ebx, eax
call fcn.00463c77
mov edx, dword [esp + 0x24]
mov ebp, eax
push ebp
push ebx
push edx
push edi
call fcn.00436c80
mov eax, dword [esp + 0x2c]
push esi
push ebx
push eax
call fcn.00436cc0
mov ecx, dword [esp + 0x38]
push esi
mov edi, eax
push ebp
push ecx
and edi, 1
call fcn.00436cc0
push ebx
and edi, eax
call fcn.00463db1
push ebp
call fcn.00463db1
add esp, 0x38
mov eax, edi
pop esi
pop ebp
pop ebx
pop edi
ret

Function at 0x436cc0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x473878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
lea ecx, [esp + 0x2c]
call fcn.0043d7b0
mov esi, dword [esp + 0x50]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 0x40], 0
fild qword [esp + 0xc]
mov dword [esp + 0x20], esi
fmul qword [str.333333]
call fcn.00463c50
push eax
call fcn.00463c77
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x1c], edi
push 0x20000
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00463c77
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], eax
call fcn.0043d940
test eax, eax
jne 0x436d97
mov eax, dword [esp + 0x18]
push eax
call fcn.00463db1
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00463db1
add esp, 8
lea ecx, [esp + 0x2c]
mov dword [esp + 0x40], 0xffffffff
call sym.RScript.exe_public:_void___thiscall_CMath::destructor_void_
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
mov esi, dword [esp + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 8]
push 0
push edx
lea eax, [esp + 0x28]
push 0xc
push eax
push esi
call edi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
and edx, 0xffff
lea ecx, [esp + 8]
push 0
push ecx
shl edx, 1
push edx
push eax
push esi
call edi
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push 0
push ecx
push edx
push eax
push esi
call edi
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00463db1
mov edx, dword [esp + 0x20]
push edx
call fcn.00463db1
add esp, 8
lea ecx, [esp + 0x2c]
mov dword [esp + 0x40], 0xffffffff
call sym.RScript.exe_public:_void___thiscall_CMath::destructor_void_
mov ecx, dword [esp + 0x38]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x440bc0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4740a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], 0x47739c
lea eax, [esi + 0x64]
mov dword [esp + 0x14], eax
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x30], 0
call dword [eax + 0xec]
mov ebp, dword [esp + 0x38]
mov ebx, ebp
imul ebx, dword [esp + 0x3c]
shl ebx, 2
push ebx
call fcn.00463c77
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi + 4], edi
jne 0x440c3e
mov ecx, dword [esp + 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x440d17
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov dword [esi + 8], edi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0xc]
test eax, eax
mov word [esi + 0x24], 0x20
je 0x440d04
mov ecx, esi
call fcn.00442750
mov eax, dword [esi + 0x10]
test eax, eax
je 0x440ce1
lea ecx, [esi + 0x3c]
sub esp, 0x10
mov edx, esp
lea edi, [esi + 0x4c]
mov eax, dword [ecx]
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, esp
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, edi
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
lea eax, [esp + 0x38]
push eax
call fcn.0044f1b0
mov ebx, eax
add esp, 0x24
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ebx, dword [ebx + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], ebx
jmp 0x440cfd
lea ecx, [esi + 0x3c]
lea edx, [esi + 0x4c]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
mov eax, dword [esp + 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 8
Function at 0x4411f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4740e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], 0x47739c
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], edi
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov ebp, 0x47773c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x28], 1
push ecx
lea ecx, [esp + 0x14]
call fcn.00435780
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x441262
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, ebx
jne 0x441292
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 2
je 0x441279
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
add edi, 4
mov dword [esp + 0x10], 0x477768
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x441365
cmp ecx, ebx
je 0x4412ac
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x4412ae
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x4412b0
xor edi, edi
xor eax, eax
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
call dword [edx + 0xe8]
test eax, eax
jne 0x4412f5
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 3
cmp ecx, ebx
je 0x4412db
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x441365
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x441317
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x441319
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x14]
jmp 0x44131b
xor edi, edi
xor eax, eax
mov esi, dword [esi + 4]
cmp ecx, ebx
je 0x441333
imul eax, edi
mov edx, dword [ecx]
shl eax, 2
push eax
push esi
call dword [edx + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 4
je 0x44134a
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x441470
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x474148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], 0x47739c
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], edi
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov ebp, 0x47773c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x30]
push ebx
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00435950
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x4414e3
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, ebx
jne 0x441513
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 2
je 0x4414fa
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
add edi, 4
mov dword [esp + 0x10], 0x477768
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x4415e6
cmp ecx, ebx
je 0x44152d
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x44152f
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x441531
xor edi, edi
xor eax, eax
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
call dword [edx + 0xe8]
test eax, eax
jne 0x441576
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 3
cmp ecx, ebx
je 0x44155c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x4415e6
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x441598
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp ecx, ebx
je 0x44159a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x14]
jmp 0x44159c
xor edi, edi
xor eax, eax
mov esi, dword [esi + 4]
cmp ecx, ebx
je 0x4415b4
imul eax, edi
mov edx, dword [ecx]
shl eax, 2
push eax
push esi
call dword [edx + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ebp
cmp ecx, ebx
mov byte [esp + 0x28], 4
je 0x4415cb
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x477768
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4