joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63205940
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
mov edi, dword fs:[0x18]
sub esp, 0x2c
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], ecx
mov dword [esp + 4], 0
mov ecx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ecx
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ecx
mov eax, dword [esi]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.ucrtbase.dll_memcpy
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x63205a58
mov eax, dword [esi + 8]
test eax, eax
je 0x632059fe
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 4], 0
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 8], eax
mov edx, dword [esi + 8]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll_strcpy]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x63205a49
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 4], 0
add eax, 1
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0xc], eax
mov edx, dword [esi + 0xc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll_strcpy]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esi + 8]
test edx, edx
je 0x63205ac0
cmp word [edx], 0
je 0x63205b40
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x63205a70
sub eax, edx
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 8], eax
mov edi, dword [esi + 8]
mov ecx, eax
sub esp, 0xc
xor eax, eax
lea esi, [esi]
movzx edx, word [edi + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x63205ab0
mov edx, dword [esi + 0xc]
test edx, edx
je 0x63205a49
cmp word [edx], 0
je 0x63205b30
mov eax, edx
nop
add eax, 2
cmp word [eax], 0
jne 0x63205ad0
sub eax, edx
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0xc], eax
mov ebx, dword [esi + 0xc]
mov ecx, eax
sub esp, 0xc
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x63205b10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x63205ade
mov eax, 2
jmp 0x63205a7e
Function at 0x63206b80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
lea edi, [ebp - 0x30]
push ebx
mov ebx, ecx
sub esp, 0x4c
mov edx, dword [0x63225480]
mov dword [esi], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], edx
mov edx, dword [0x63225484]
mov dword [ecx], 0
mov eax, dword [esi]
mov dword [ebp - 0x2c], edx
mov edx, dword [0x63225488]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [ebp - 0x28], edx
mov edx, dword [0x6322548c]
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x24], edx
call fcn.63218af0
cmp eax, 0x8877001e
je 0x63206c48
test byte [0x6321d03c], 2
jne 0x63206c10
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call fcn.632132a0
mov dword [esp + 0xc], str.cant_get_buffer_size:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DP_BuildSPCompoundAddr
mov dword [esp + 4], 0x6321d03c
mov dword [esp], 1
call fcn.63205bb0
jmp 0x63206bfc
mov edx, dword [ebx]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [esi], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edi
call fcn.63218af0
mov edx, eax
mov eax, 1
test edx, edx
jns 0x63206bfe
test byte [0x6321d03c], 2
je 0x63206bfc
mov dword [esp], edx
call fcn.632132a0
mov dword [esp + 0xc], str.cant_create_address:__s_n
mov dword [esp + 0x10], eax
jmp 0x63206c24
Function at 0x63208bc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
test byte [0x6321d03c], 8
jne 0x63208c90
mov eax, dword [ebx + 0x54]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x63208d40
test edi, edi
jne 0x63208d50
mov edx, dword [eax + 0x14]
test edx, edx
je 0x63208d30
mov edx, dword [ebp + 0xc]
mov eax, esi
call fcn.63208ad0
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x63208d5a
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebp + 0xc]
mov edx, esi
sub esp, 0xc
mov dword [eax + 0x1c], edi
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x1c]
call fcn.63208970
mov eax, dword [ebp + 8]
test eax, eax
jne 0x63208cd8
test byte [0x6321d03c], 1
jne 0x63208d00
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], str.__p_____p_0x_08lx__u__u__n
mov dword [esp + 8], str.DP_SetSessionDesc
mov dword [esp + 4], 0x6321d03c
mov dword [esp], 3
call fcn.63205bb0
jmp 0x63208bdc
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x1c]
add eax, 8
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Need_to_send_a_DPMSG_SETSESSIONDESC_msg_to_everyone_n
mov dword [esp + 8], str.DP_SetSessionDesc
mov dword [esp + 4], 0x6321d03c
mov dword [esp], 0
call fcn.63205bb0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x8877000a
jmp 0x63208c88
mov eax, 0x88770140
jmp 0x63208c88
mov eax, 0x80070057
jmp 0x63208c88
mov eax, 0x8007000e
jmp 0x63208c88
Function at 0x6320c4d0
Capabilities:
Get process heap flags
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov eax, dword [eax + 0x54]
mov edx, dword [eax + 4]
cmp edx, 0xffffffff
je 0x6320c50f
mov dword [esp], edx
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [ebx + 0x54]
sub esp, 8
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0x48]
test edx, edx
je 0x6320c638
test byte [0x6321d03c], 8
jne 0x6320c600
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call edx
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x70]
test edx, edx
je 0x6320c554
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x74]
test edx, edx
je 0x6320c56a
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov eax, dword [eax + 0x10]
mov edi, dword fs:[0x18]
mov dword [esp], eax
call fcn.6321aba0
mov eax, dword [ebx + 0x54]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x5c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x54]
sub esp, 0xc
mov eax, dword [eax + 0x1c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x54]
sub esp, 0xc
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Calling_SP_ShutdownEx_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x6321d03c
mov dword [esp], 3
call fcn.63205bb0
mov eax, dword [ebx + 0x54]
mov edx, dword [eax + 0x30]
mov edx, dword [edx + 0x48]
jmp 0x6320c52a
mov edx, dword [ecx + 0x40]
test edx, edx
je 0x6320c53e
test byte [0x6321d03c], 8
jne 0x6320c660
call edx
mov eax, dword [ebx + 0x54]
jmp 0x6320c53e
mov dword [esp + 0xc], str.Calling_obsolete_SP_Shutdown_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x6321d03c
mov dword [esp], 3
call fcn.63205bb0
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x40]
jmp 0x6320c64c
Function at 0x6320cb30
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x3c
mov dword [ebp - 0x1c], edx
mov dword [esp + 8], 0x44
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6320cbaa
mov dword [eax + 8], 0
lea eax, [eax + 8]
mov edx, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [esi]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x20], eax
test edx, edx
je 0x6320cc00
cmp dword [edx], 0x10
je 0x6320cbf0
mov eax, dword [ebp + 8]
mov dword [ebx + 0x1c], edi
mov dword [ebx], eax
test byte [0x6321d03c], 8
jne 0x6320cbb8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov dword [esp + 0xc], str.Created_group_id_0x_08lx_n
mov dword [esp + 8], str.DP_CreateGroup
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x6321d03c
mov dword [esp], 3
call fcn.63205bb0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
lea eax, [ebx + 0x24]
call fcn.63205940
jmp 0x6320cb99
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x24], 0x10
jmp 0x6320cb99
Function at 0x6320ee40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
leave
ret
Function at 0x63210be0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test byte [0x6321d04c], 8
jne 0x63210c70
mov dword [edi], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x63210d3f
mov dword [eax], str.p_t_cP
mov dword [eax + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [ebx + 0x18], eax
call fcn.63210970
mov esi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x63210d38
mov eax, esi
shr eax, 0x10
je 0x63210d20
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x63222014
mov dword [esp + 4], eax
call fcn.6320fb40
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x63222097
mov dword [esp + 8], str.dplaysp_create
mov dword [esp + 4], 0x6321d04c
mov dword [esp], 3
call fcn.6320fc00
jmp 0x63210bf8
movzx eax, si
mov dword [esp], 0x63222004
mov dword [esp + 4], eax
call fcn.6320fb40
jmp 0x63210ce5
mov eax, 0x63221ffd
jmp 0x63210ce5
mov esi, 0x8007000e
jmp 0x63210c63

Function at 0x63210d50
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test byte [0x6321d04c], 8
jne 0x63210d90
mov dword [esp + 8], 0x10
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
leave
ret
mov dword [esp + 0xc], str.Creating_SPPlayer_data_struct_n
mov dword [esp + 8], str.DPSP_CreateSPPlayerData
mov dword [esp + 4], 0x6321d04c
mov dword [esp], 3
call fcn.6320fc00
jmp 0x63210d5f
Function at 0x63213f20
Capabilities:
Create thread
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x63214099
mov ebx, eax
test esi, esi
je 0x63213fa0
lea eax, [eax + 0xc]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], esi
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x63214000
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x63213d20
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x63214040
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [0x6321d07c], 2
jne 0x63214070
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [0x6321d07c], 2
je 0x63214009
mov dword [esp + 0xc], str.Unable_to_create_msg_thread_n
mov dword [esp + 8], str.CreateLobbyMessageReceptionThread
mov dword [esp + 4], 0x6321d07c
mov dword [esp], 1
call fcn.63213b30
jmp 0x63214009
mov dword [esp + 0xc], str.Unable_to_duplicate_event_handle_n
mov dword [esp + 8], str.CreateLobbyMessageReceptionThread
mov dword [esp + 4], 0x6321d07c
mov dword [esp], 1
call fcn.63213b30
jmp 0x63214009
xor eax, eax
jmp 0x63213ff7
Function at 0x632140a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov edx, dword fs:[0x18]
mov ebp, esp
push esi
push ebx
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x48]
mov dword [esp + 4], 8
add eax, 0xc
mov dword [esp + 8], eax
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebx + 0x54]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], eax
sub esp, 0xc
mov edx, dword [ecx + 0x48]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0
add edx, eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], 0
mov dword [edx], 0x79616c70
mov dword [edx + 4], 0xb0005
mov dword [edx + 8], esi
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x34]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], eax
test byte [0x6321d07c], 8
jne 0x63214198
lea eax, [ebp - 0x28]
mov dword [esp], 7
mov ecx, 0x7530
lea edx, [ebp - 0x24]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, ebx
call fcn.63213b80
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
test byte [0x6321d07c], 8
jne 0x632141c8
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.Asking_for_player_id_w__dwFlags_0x_08lx_n
mov dword [esp + 8], str.DP_MSG_SendRequestPlayerId
mov dword [esp + 4], 0x6321d07c
mov dword [esp], 3
call fcn.63213b30
jmp 0x6321412e
mov eax, dword [eax + 8]
mov dword [esp + 0xc], str.Received_reply_for_id__0x_08lx_n
mov dword [esp + 8], str.DP_MSG_SendRequestPlayerId
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x6321d07c
mov dword [esp], 3
call fcn.63213b30
mov eax, dword [ebp - 0x2c]
jmp 0x63214166
Function at 0x63214480
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
movzx edi, word [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebx + 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [ecx + 0x7c]
mov ebx, edx
jmp 0x632144c6
mov eax, dword [ebx]
cmp word [ebx + 0xc], di
je 0x632144f8
cmp edx, eax
je 0x632144ca
mov ebx, eax
test ebx, ebx
jne 0x632144b8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test byte [0x6321d07c], 2
jne 0x63214580
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.kernel32.dll_DebugBreak]
mov edx, dword [ebx + 4]
test eax, eax
je 0x63214570
mov dword [eax + 4], edx
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [ebx + 0x14], esi
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [ebx + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ecx + 0x80], edx
jmp 0x63214502
mov dword [esp + 0xc], str.No_receipt_event_set___only_expecting_in_reply_mode_n
mov dword [esp + 8], str.DP_MSG_ReplyReceived
mov dword [esp + 4], 0x6321d07c
mov dword [esp], 1
call fcn.63213b30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.kernel32.dll_DebugBreak]

Function at 0x632145c0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov edx, dword fs:[0x18]
mov ebp, esp
push ebx
sub esp, 0x44
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x48]
mov dword [esp + 4], 8
add eax, 8
mov dword [ebp - 0x28], eax
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebx + 0x54]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], eax
sub esp, 0xc
mov ecx, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
add ecx, eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 1
mov dword [ecx], 0x79616c70
mov dword [ecx + 4], 0xb03e8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x34]
lea edx, [ebp - 0x24]
mov dword [esp], 0x3e8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, ebx
mov dword [ebp - 0x20], ecx
mov ecx, 0x1388
call fcn.63213b80
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x63215ae0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x50]
test eax, eax
je 0x63215b82
test byte [0x6321d08c], 1
je 0x63215b82
mov dword [esp + 0xc], str.Should_kill_the_msg_thread_n
mov dword [esp + 8], str.dplobby_destroy
mov dword [esp + 4], 0x6321d08c
mov dword [esp], 0
call fcn.632158a0
mov eax, dword [ebx + 0x54]
test eax, eax
jne 0x63215b89
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x18], 0
lea eax, [ebx + 0x34]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
mov dword [edx + 4], ecx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [esp], eax
call fcn.6320ee40
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x63215b2c
mov edx, dword [eax]
mov ecx, dword [eax + 4]
test edx, edx
jne 0x63215b70
mov dword [ebx + 0x58], ecx
jmp 0x63215b73