joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a3dd
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.004404f0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44a472
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x463cd4]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x44a472
cmp eax, 1
je 0x44a48a
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44a472
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x44a447
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x44a46e
xor eax, eax
inc eax
jmp 0x44a4a6
cmp esi, ebx
jae 0x44a476
xor eax, eax
jmp 0x44a4a6
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x463cd4]
jmp 0x44a48c
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44b785
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x44b7f0
push 0x3d
push dword [ebp + 8]
call fcn.0044c0dd
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x44b7f0
cmp dword [ebp + 8], esi
je 0x44b7f0
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x463cf4]
cmp eax, dword [0x463cf8]
jne 0x44b7d6
mov edi, eax
call fcn.0044b724
mov dword [0x463cf4], eax
cmp eax, ebx
jne 0x44b82f
cmp dword [ebp + 0xc], ebx
je 0x44b7f8
cmp dword [0x463cfc], ebx
je 0x44b7f8
call fcn.0044974c
test eax, eax
je 0x44b82f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x44b933
push 4
call fcn.00440614
cmp eax, ebx
pop ecx
mov dword [0x463cf4], eax
je 0x44b7f0
mov dword [eax], ebx
cmp dword [0x463cfc], ebx
jne 0x44b82f
push 4
call fcn.00440614
cmp eax, ebx
pop ecx
mov dword [0x463cfc], eax
je 0x44b7f0
mov dword [eax], ebx
mov ebx, dword [0x463cf4]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.0044b6d7
mov edi, eax
test edi, edi
pop ecx
jl 0x44b888
cmp dword [ebx], 0
je 0x44b888
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.004401f9
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x44b870
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x44b8be
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x44b867
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.0044004c
test eax, eax
pop ecx
pop ecx
je 0x44b8be
jmp 0x44b8b9
cmp dword [ebp - 4], 0
jne 0x44b92c
test edi, edi
jge 0x44b898
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.0044004c
test eax, eax
pop ecx
pop ecx
je 0x44b7f0
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x463cf4], eax
cmp dword [ebp + 0xc], 0
je 0x44b915
push dword [ebp + 8]
call fcn.00444370
inc eax
inc eax
push eax
call fcn.00440614
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x44b915
push dword [ebp + 8]
push esi
call fcn.004441c0
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x44b90e
or dword [ebp - 8], 0xffffffff
push esi
call fcn.004401f9
pop ecx
cmp dword [ebp - 4], 0
je 0x44b924
push dword [ebp + 8]
call fcn.004401f9
pop ecx
mov eax, dword [ebp - 8]
jmp 0x44b7f3
push esi
call fcn.004401f9
pop ecx
xor eax, eax
jmp 0x44b7f3

Function at 0x44e6f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0x454348
push 0x45fb10
call fcn.00441532
add esp, 0xc
push 1
call fcn.0043fe8d
int3
Function at 0x1c22fc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x1c234e0
test edx, edx
je 0x1c234e0
call fcn.01c22fd7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x1c26cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.01c26cc9

Function at 0x1c334a1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1cf7014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0xd
call fcn.01c3359e
test al, al
je 0x1c3358a
push 0
call fcn.01c57660
add esp, 4
test eax, eax
je 0x1c33560
mov esi, eax
mov eax, dword [eax]
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
lea ecx, [ebp - 0x14]
mov dword [ecx], 0
mov eax, 0x40
push ecx
push eax
push eax
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1c33567
push 0x1ce4f4c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
xor edi, edi
mov ecx, esi
push edi
push 0x40
push section..crthunk
push 0x1c330f0
push edi
push str.NtMapViewOfSection
push 0x1c20000
push dword [ebp - 0x18]
call ebx
test eax, eax
js 0x1c3356e
lea eax, [ebp - 0x14]
push eax
push 0x20
push 0x40
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1c33578
mov edi, 0xe
jmp 0x1c3358a
mov edi, 0xf
jmp 0x1c33578
mov dword [0x1cfbd04], eax
mov edi, 0x10
mov eax, dword [esi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 1
call ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb0ac3
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c35a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x1c60760
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret

Function at 0x1c3650c
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x1c3655a
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c36534
cmp edx, 1
je 0x1c3657b
cmp edx, 2
je 0x1c36572
cmp edx, 3
jne 0x1c36586
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x1c39efc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x1c39f0e
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ecx + 0xc]
test edx, edx
je 0x1c39f38
mov esi, dword [ecx + 4]
mov edi, dword [edx + 0x3c]
lea ebx, [edi + 0x18]
xor eax, eax
cmp ebx, esi
ja 0x1c39f09
add edx, edi
cmp dword [edx], 0x4550
jne 0x1c39f09
add edx, 4
mov dword [ecx + 0x10], edx
mov eax, edx
jmp 0x1c39f09
mov edx, dword [ecx]
xor eax, eax
test edx, edx
je 0x1c39f09
mov dword [ecx + 0xc], edx
mov esi, dword [ecx + 4]
cmp esi, 0x40
jb 0x1c39f56
movzx edi, word [edx]
cmp edi, 0x5a4d
je 0x1c39f18
mov dword [ecx + 0xc], 0
jmp 0x1c39f09
Function at 0x1c3a366
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, 0xa
mov edx, dword [ecx + eax*4]
bswap edx
mov dword [ecx + eax*4], edx
inc eax
cmp eax, 0x1a
jne 0x1c3a374
mov eax, 0x1a
mov edx, dword [ecx + eax*4 - 0x20]
xor edx, dword [ecx + eax*4 - 0xc]
xor edx, dword [ecx + eax*4 - 0x38]
xor edx, dword [ecx + eax*4 - 0x40]
rol edx, 1
mov dword [ecx + eax*4], edx
inc eax
cmp eax, 0x5a
jne 0x1c3a387
mov edi, dword [ecx + 0x14]
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x20], eax
mov edx, dword [ecx + 0x1c]
mov eax, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x24]
xor ebx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov esi, dword [ebp - 0x1c]
mov ecx, edx
mov edx, eax
mov eax, edi
rol eax, 5
cmp ebx, 0x14
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], edi
jae 0x1c3a40a
mov edi, esi
and edi, ecx
add edi, eax
mov eax, esi
not eax
and eax, edx
add edi, eax
add edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add edi, dword [eax + ebx*4 + 0x28]
mov edx, 0x5a827999
jmp 0x1c3a45f
cmp ebx, 0x28
jae 0x1c3a428
mov edi, ecx
xor edi, edx
xor edi, esi
add edi, eax
add edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add edi, dword [eax + ebx*4 + 0x28]
mov edx, 0x6ed9eba1
jmp 0x1c3a45f
cmp ebx, 0x3b
ja 0x1c3a448
mov edi, edx
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
or edx, edi
and edx, esi
mov edi, dword [ebp - 0x24]
and edi, dword [ebp - 0x14]
or edi, edx
mov edx, 0x8f1bbcdc
jmp 0x1c3a453
mov edi, ecx
xor edi, edx
xor edi, esi
mov edx, 0xca62c1d6
add edi, eax
add edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add edi, dword [eax + ebx*4 + 0x28]
add edi, edx
rol esi, 0x1e
inc ebx
mov eax, ecx
mov edx, esi
cmp ebx, 0x50
jne 0x1c3a3ce
mov ebx, dword [ebp - 0x10]
mov dword [ebx], edi
mov eax, dword [ebp - 0x28]
add eax, edi
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], esi
mov edi, dword [ebp - 0x1c]
mov dword [ebx + 4], edi
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x20]
add eax, edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x2c]
add eax, esi
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x30]
add eax, ecx
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x34]
add eax, edx
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x168], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c43350
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
lea ecx, [esi + 0x50]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x1c53c20
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x29]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.01c50b3a
add esp, 0x10
mov dword [esi + 4], esp
lea eax, [esi + 0x18]
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov byte [eax + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.01c3f680
add esp, 4
lea eax, [esi + 0x18]
mov dword [edi], eax
mov dword [edi + 4], 0xd
lea eax, [esi + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.01c56e0e
add esp, 0x1c
mov esp, dword [esi + 4]
add eax, esi
add eax, 0x18
mov dword [esi + 4], eax
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.01c440ca
add esp, 0xc
mov dword [esi + 0x14], eax
lea edi, [esi + 0x30]
mov dword [edi + 0x13], ebx
mov dword [edi + 0xf], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea eax, [esi + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0xc]
mov dword [eax], ebx
lea ebx, [esi + 8]
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.01c3b6da
lea eax, [esi + 0x50]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
push edi
push dword [esi + 4]
push dword [esi + 0x14]
lea eax, [esi + 0x18]
push eax
call fcn.01c452c0
add esp, 0x1c
mov ebx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
test eax, eax
jne 0x1c43486
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x58], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x58], 0xffffffff
movsx edx, dl
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.01c35c29
add esp, 0x1c
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x1c43720
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
lea ecx, [esi + 0x50]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x1c53c40
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x29]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edi + 4]
push edx
push ecx
push eax
call fcn.01c50b3a
add esp, 0x10
mov dword [esi + 4], esp
lea eax, [esi + 0x18]
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov byte [eax + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.01c3f680
add esp, 4
lea eax, [esi + 0x18]
mov dword [edi], eax
mov dword [edi + 4], 0xd
lea eax, [esi + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.01c56e0e
add esp, 0x1c
mov esp, dword [esi + 4]
add eax, esi
add eax, 0x18
mov dword [esi + 4], eax
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.01c440ca
add esp, 0xc
mov dword [esi + 0x14], eax
lea edi, [esi + 0x30]
mov dword [edi + 0x13], ebx
mov dword [edi + 0xf], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea eax, [esi + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0xc]
mov dword [eax], ebx
lea ebx, [esi + 8]
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.01c3b6da
lea eax, [esi + 0x50]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
push edi
push dword [esi + 4]
push dword [esi + 0x14]
lea eax, [esi + 0x18]
push eax
call fcn.01c452c0
add esp, 0x1c
mov ebx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
test eax, eax
jne 0x1c43855
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x58], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x58], 0xffffffff
movsx edx, dl
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.01c35c29
add esp, 0x1c
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x1c43f30
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0xc], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x1c53f90
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea ebx, [esi + 0x50]
mov dword [ebx + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
push eax
sub esp, 0x18
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.01c3f680
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x14
mov dword [edi + 0x14], 0x1ce5443
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.01c56e0e
add esp, 0x1c
mov esp, dword [esi + 0xc]
mov dword [esi + 0xc], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
push eax
push ebx
call fcn.01c440ca
add esp, 0xc
mov dword [esi + 0x18], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 0x10]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.01c3b6da
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
mov ecx, edi
push 0x1cfc268
call fcn.01c4eca8
mov ebx, eax
mov edi, dword [esi + 0x10]
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x1c44029
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x78], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [esi + 0x14]
mov eax, dword [ebx]
mov edi, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
lea eax, [esi + 0x20]
mov ecx, ebx
push eax
mov ebx, dword [esi + 0x1c]
push ebx
lea eax, [esi + 0x50]
push eax
call edi
mov ecx, dword [esi + 0x18]
mov eax, ecx
lea edx, [esi + 0x50]
sub eax, edx
cmp ecx, ebx
mov ecx, dword [esi + 0xc]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.01c35c29
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x1c44340
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x1c53c70
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.01c50b3a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.01c3f680
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.01c56e0e
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.01c440ca
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.01c3b6da
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.01c45b30
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x1c4447b
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.01c45140
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x1c44520
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x1c53c80
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.01c50b3a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.01c3f680
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.01c56e0e
add esp, 0x20
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.01c440ca
add esp, 0xc
mov dword [esi + 8], eax
lea ebx, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x4a], xmm0
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.01c3b6da
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.01c45b30
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x1c4467e
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.01c45140
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c