joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469143
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x4691f9
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x4691d9
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x4691b4
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x4691ee
add edi, dword [esp + 0x14]
jmp 0x4691f2
add edi, dword [esp + 0x24]
test edx, edx
jne 0x469192
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x469504
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x4695de
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x4695b4
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x46957c
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x4695cb
add edi, ecx
jmp 0x4695cf
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x469552
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x469bfe
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x469cb3
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x469c94
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x469c6f
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x469ca9
add edx, dword [esp + 0x14]
jmp 0x469cad
add edx, dword [esp + 0x24]
test esi, esi
jne 0x469c4d
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x43fa03
Capabilities:
Hash data with crc32

Disassembly:
je 0x43fbf7
jne 0x43fbf7
cmp dword [0x69a7642c], esi
lea edi, [eax + 0xcd0ea8]
cmp dword [0xd0c3a8], ecx
or dword [eax + 0x20], 0x80
mov byte [eax + esi - 1], 0
cmp dword [0xdeb3d8], edi
mov dword [0x112765ac], eax
mov dword [esi], 0xace0bc
movsx eax, word [ebp - 0x1c4]
push 0xaab9a8
int1
rcr byte [esi], 1
loop 0x43f2e7
sub eax, 0x22a93090
aaa
out 0x83, al
leave
jmp [eax + 3]
movsd dword es:[edi], dword [esi]
add byte [eax + 0x4561b4], bh
mov eax, 0x10d7a2b8
mov edx, 0xb1ced4
push 0xa76714
mov dword [esi], 0x9fb764
push str.4Int
mov dword [edx + esi + 0x13c], 0x10261f8c
push 0x697a2e6c
mov byte [ebp - 0x132], 0
mov ecx, 0x15
sti
and bh, byte [edi + 0x4232049f]
cmp byte [eax], bl
mov al, byte [0x6b249244]
dec edi
arpl word [eax], bx
cwde
jmp 0x43fa03
not ecx
xor ebx, ebx
je 0x43fafa
jne 0x43fafa
cmp dword [ebp + 0xc], eax
jmp dword [ecx*4 + 0x86d66c]
shr ecx, 8
je 0x43f8c9
jne 0x43f8c9
mov dword [0x112b2da8], eax
neg dword [ebp + 0x12]
push 0xa233fc
push 0x1016adc0
mov dword [0x1124da0c], eax
mov dword [0x111d2de4], eax
cmp dword [ebp + 0x1c], 0x80000000
mov dword [esi], 0xa0e618
pmaddwd xmm6, xmmword [0x69809430]
mov eax, 0x10dab0f8
push 0x100d8c6c
mov ecx, dword [0x42be3c]
movzx eax, word [0xf376c4]
add ebp, 0x518
mov dword [esi + 0x5c], 0x42edc0
push 0xaf4520
cmp byte [0xdef019], 0
mov dword [esp + 0xec], 0x1028d9a4
hlt
mov dword [ebp - 0x128], ebx
mov dword [ebp - 4], 0xfffffffe
push 0x43fb85
ret
push eax
push 0x43fe3a
ret
je 0x43f33b
movzx eax, byte [esi]
xor eax, ecx
je 0x43fd59
jne 0x43fd59
mov ecx, dword [0x1152b260]
lock cmpxchg dword [ebx], edx
mov dword [esi + 0x694], 1
mov dword [esi + 4], 0x63eba0
jmp dword [0x49140c]
xor ecx, dword [eax*4 + 0x401240]
push 0x43f5f1
ret
mov eax, edx
dec edx
mov dword [ebp - 0x130], edx
test eax, eax
jmp 0x43f814
mov dword [ebp - 0x124], esi
jmp 0x43f925
cmp ecx, 0x39b5d60d
sete bl
jmp 0x43f464
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b19b0
push 0x4a41c0
mov eax, dword fs:[0]
jmp 0x43f67a
and eax, 0xff
jmp 0x43f37a
Function at 0x10048740
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a36b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1006b850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
call fcn.10047940
lea ecx, [edi + 0x18]
call fcn.10045440
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 4], 0
mov eax, dword [edi + 8]
shl eax, 3
push eax
mov dword [ebp - 4], 0
call fcn.10047960
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10049930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, 1
or eax, 0xffffffff
mov cl, byte [esi]
shl edi, cl
dec edi
cmp dword [esi + 4], edx
jle 0x1004996f
push ebx
mov ebx, dword [ebp + 8]
nop
movsx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
sar eax, 8
and ecx, 0xff
and eax, 0xffffff
xor eax, dword [esi + ecx*4 + 0x20]
cmp edx, dword [esi + 4]
jl 0x10049950
pop ebx
not eax
and eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403280
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41a008], 0x8088405
inc edx
mov dword [ebx + 0x41a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4175fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404abc
xor eax, eax
push ebp
push 0x417684
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040460c
mov eax, dword [ebp - 4]
call fcn.004048cc
mov esi, eax
test esi, esi
jle 0x41765f
mov ebx, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor edx, ebx
call fcn.004047f4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.004048d4
inc ebx
dec esi
jne 0x41763e
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404660
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41768b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404630
ret

Function at 0x417694
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404abc
xor eax, eax
push ebp
push 0x41772a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404acc
call fcn.0040b6f0
mov ebx, eax
test ebx, ebx
jle 0x4176fc
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor edx, edi
call fcn.004047f4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004048d4
inc esi
dec ebx
jne 0x4176db
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404660
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417731
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404630
lea eax, [ebp - 4]
call fcn.0040460c
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x6f243520
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov ebx, dword [esp + 0x6c]
test byte [0x6f266058], 8
jne 0x6f2435c0
mov ebp, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [esp + 0xc], 1
lea eax, [esp + 0x34]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersion
mov dword [esp], 0x80000002
call ebp
sub esp, 0x14
test eax, eax
je 0x6f243610
test byte [0x6f266058], 8
jne 0x6f243659
mov eax, dword [esp + 0x60]
shr ebx, 1
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], str.SYSTEM.INI
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0x6f2681ec
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
sub esp, 0x18
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call fcn.6f242800
mov ebp, eax
mov eax, dword [esp + 0x60]
call fcn.6f242800
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.registry:__s___s___p___d_n
mov dword [esp + 8], 0x6f2684c8
mov dword [esp + 4], 0x6f266058
mov dword [esp], 3
call fcn.6f242aa0
jmp 0x6f243540
lea eax, [esp + 0x38]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0x14
test eax, eax
je 0x6f2436a8
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x6f266058], 8
je 0x6f243587
mov eax, esi
call fcn.6f242800
mov ebp, eax
mov eax, dword [esp + 0x60]
call fcn.6f242800
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.system.ini:__s___s___p___d_n
mov dword [esp + 8], 0x6f2684c8
mov dword [esp + 4], 0x6f266058
mov dword [esp], 3
call fcn.6f242aa0
jmp 0x6f243587
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0x18
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebp
sub esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call ebp
mov eax, 1
sub esp, 4
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x6f2435b5
jmp 0x6f24357a
Function at 0x6f243ff0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x6f2440b6
mov ecx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], ecx
call ecx
mov edx, eax
sub esp, 0x18
lea ebx, [edx + edx]
mov dword [ebp - 0x20], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6f2441db
mov edx, dword [ebp - 0x20]
mov dword [esp + 8], esi
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp + 0x14], edx
mov dword [esp], 0
mov ecx, dword [ebp - 0x24]
call ecx
sub esp, 0x18
test edi, edi
je 0x6f2441d0
mov ecx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], ecx
call ecx
mov edx, eax
sub esp, 0x18
lea ebx, [edx + edx]
mov dword [ebp - 0x20], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6f2441d4
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp + 0x14], edx
mov dword [esp], 0
mov ecx, dword [ebp - 0x24]
call ecx
sub esp, 0x18
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.winmm.dll_DrvOpen
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], esi
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
xor ebx, ebx
jmp 0x6f24415b
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x6f244174
xor edx, edx
xor esi, esi
mov dword [ebp - 0x1c], edx
jmp 0x6f244174
Function at 0x6f247270
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
test byte [0x6f266140], 8
jne 0x6f247370
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x6f2473ed
xor eax, eax
jmp 0x6f2472d4
add eax, 1
cmp eax, 0x28
je 0x6f2473c0
mov edx, dword [eax*4 + 0x6f27a000]
test edx, edx
jne 0x6f2472c8
mov dword [eax*4 + 0x6f27a000], edi
or ah, 0x80
mov ebp, eax
mov dword [edi + 4], ebx
mov dword [esi], ebp
mov dword [esp], ebx
call fcn.6f246f60
cmp ebp, eax
jae 0x6f247338
test byte [0x6f266140], 2
jne 0x6f247348
mov eax, dword [esp + 0x5c]
mov eax, dword [eax]
shr eax, 0x10
mov word [edi + 0x10], ax
mov eax, dword [esp + 0x64]
movd xmm1, dword [eax]
mov eax, dword [esp + 0x60]
movd xmm0, dword [eax]
mov eax, edi
punpckldq xmm0, xmm1
movq qword [edi + 0x14], xmm0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [esi + 2], 0
je 0x6f247305
test byte [0x6f266140], 2
je 0x6f247305
mov dword [esp + 0xc], str.Shouldnt_happen._Bad_allocation_scheme_n
mov dword [esp + 8], str.MMDRV_Alloc
mov dword [esp + 4], 0x6f266140
mov dword [esp], 1
call fcn.6f245ff0
jmp 0x6f247305
mov eax, dword [esp + 0x64]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__d___04x___p___p___p___p__n
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], str.MMDRV_Alloc
mov dword [esp + 4], 0x6f266140
mov dword [esp], 3
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], eax
call fcn.6f245ff0
jmp 0x6f247290
test byte [0x6f266140], 2
jne 0x6f2473f9
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
add esp, 0x3c
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Too_many_open_drivers_n
mov dword [esp + 8], str.MMDRV_Alloc
mov dword [esp + 4], 0x6f266140
mov dword [esp], 1
call fcn.6f245ff0
jmp 0x6f2473c9
Function at 0x6f247420
Capabilities:
Get process heap flags

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
test byte [0x6f266140], 8
jne 0x6f247458
test bh, 0x80
je 0x6f247444
mov eax, ebx
and ah, 0x7f
cmp eax, 0x27
jbe 0x6f2474c8
test byte [0x6f266140], 2
jne 0x6f247490
add esp, 0x28
pop ebx
ret
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6f269a09
mov dword [esp + 8], str.MMDRV_Free
mov dword [esp + 4], 0x6f266140
mov dword [esp + 0x14], eax
mov dword [esp], 3
call fcn.6f245ff0
jmp 0x6f247431
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Bad_Handle__p_at__p__not_freed__n
mov dword [esp + 8], str.MMDRV_Free
mov dword [esp + 4], 0x6f266140
mov dword [esp + 0x14], eax
mov dword [esp], 1
call fcn.6f245ff0
add esp, 0x28
pop ebx
ret
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0
mov dword [eax*4 + 0x6f27a000], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
add esp, 0x28
pop ebx
ret
Function at 0x6f247ba0
Capabilities:
Get process heap flags

Disassembly:
push esi
push ebx
sub esp, 0x14
test byte [0x6f266140], 8
jne 0x6f247dac
xor ebx, ebx
jmp 0x6f247bc8
add ebx, 1
cmp ebx, 0x28
je 0x6f247c08
mov eax, dword [ebx*4 + 0x6f27a000]
test eax, eax
je 0x6f247bc0
test byte [0x6f266140], 1
je 0x6f247bc0
mov dword [esp + 0xc], 0x6f269b44
add ebx, 1
mov dword [esp + 8], str.MMDRV_Exit
mov dword [esp + 4], 0x6f266140
mov dword [esp], 0
call fcn.6f245ff0
cmp ebx, 0x28
jne 0x6f247bc8
mov ebx, 0x6f27a2ec
lea esi, [esi]
mov eax, ebx
xor edx, edx
mov esi, ebx
call fcn.6f2464f0
mov eax, ebx
mov edx, 1
call fcn.6f2464f0
mov eax, ebx
mov edx, 2
call fcn.6f2464f0
mov eax, ebx
mov edx, 3
call fcn.6f2464f0
mov eax, ebx
mov edx, 4
call fcn.6f2464f0
mov eax, ebx
mov edx, 5
sub ebx, 0x54
call fcn.6f2464f0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x54]
mov dword [esp], eax
call sym.winmm.dll_CloseDriver
sub esp, 0xc
cmp esi, 0x6f27a0a0
jne 0x6f247c10
mov eax, dword [0x6f2660e8]
test eax, eax
je 0x6f247cb1
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f2660f8]
test eax, eax
je 0x6f247ce2
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f266108]
test eax, eax
je 0x6f247d13
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f266118]
test eax, eax
je 0x6f247d44
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f266128]
test eax, eax
je 0x6f247d75
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f266138]
test eax, eax
je 0x6f247da6
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x6f269800
mov dword [esp + 8], str.MMDRV_Exit
mov dword [esp + 4], 0x6f266140
mov dword [esp], 3
call fcn.6f245ff0
jmp 0x6f247bb2