joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4142f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x432110
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
lea eax, [esi - 1]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x1c], 1
jge 0x414387
lea eax, [ebx + ebx*2]
lea ecx, [esp + 0x30]
push ecx
lea edi, [ebp + eax*8]
push edi
lea ecx, [esp + 0x50]
call fcn.0040dea0
test al, al
je 0x414387
lea edx, [esi + esi*2]
lea esi, [ebp + edx*8]
push edi
mov ecx, esi
call fcn.00412ba0
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
call fcn.004072a0
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
lea eax, [ebx - 1]
mov dword [esi + 0x14], edx
cdq
sub eax, edx
mov esi, ebx
sar eax, 1
cmp dword [esp + 0x2c], esi
mov ebx, eax
jl 0x414334
lea eax, [esi + esi*2]
lea ecx, [esp + 0x30]
lea esi, [ebp + eax*8]
push ecx
mov ecx, esi
call fcn.00412ba0
lea edx, [esp + 0x3c]
lea ecx, [esi + 0xc]
push edx
call fcn.004072a0
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
mov dword [esi + 0x14], ecx
lea ecx, [esp + 0x30]
mov dword [esi + 0x10], eax
mov byte [esp + 0x1c], 0
call fcn.0040a550
lea ecx, [esp + 0x48]
call fcn.0040d8c0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4143e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x432138
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
lea eax, [esi - 1]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x1c], 0
jge 0x414477
lea eax, [ebx + ebx*2]
lea ecx, [esp + 0x30]
push ecx
lea edi, [ebp + eax*8]
push edi
lea ecx, [esp + 0x50]
call fcn.0040cbb0
test al, al
je 0x414477
lea edx, [esi + esi*2]
lea esi, [ebp + edx*8]
push edi
mov ecx, esi
call fcn.00412ba0
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
call fcn.004072a0
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
lea eax, [ebx - 1]
mov dword [esi + 0x14], edx
cdq
sub eax, edx
mov esi, ebx
sar eax, 1
cmp dword [esp + 0x2c], esi
mov ebx, eax
jl 0x414424
lea eax, [esi + esi*2]
lea ecx, [esp + 0x30]
lea esi, [ebp + eax*8]
push ecx
mov ecx, esi
call fcn.00412ba0
lea edx, [esp + 0x3c]
lea ecx, [esi + 0xc]
push edx
call fcn.004072a0
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
mov dword [esi + 0x14], ecx
lea ecx, [esp + 0x30]
mov dword [esi + 0x10], eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040a550
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4144d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x432168
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
lea eax, [esi - 1]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x1c], 0
jge 0x414567
lea eax, [ebx + ebx*2]
lea ecx, [esp + 0x30]
push ecx
lea edi, [ebp + eax*8]
push edi
lea ecx, [esp + 0x50]
call fcn.0040cc50
test al, al
je 0x414567
lea edx, [esi + esi*2]
lea esi, [ebp + edx*8]
push edi
mov ecx, esi
call fcn.00412ba0
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
call fcn.004072a0
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
lea eax, [ebx - 1]
mov dword [esi + 0x14], edx
cdq
sub eax, edx
mov esi, ebx
sar eax, 1
cmp dword [esp + 0x2c], esi
mov ebx, eax
jl 0x414514
lea eax, [esi + esi*2]
lea ecx, [esp + 0x30]
lea esi, [ebp + eax*8]
push ecx
mov ecx, esi
call fcn.00412ba0
lea edx, [esp + 0x3c]
lea ecx, [esi + 0xc]
push edx
call fcn.004072a0
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
mov dword [esi + 0x14], ecx
lea ecx, [esp + 0x30]
mov dword [esi + 0x10], eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040a550
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4148c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4321d2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov eax, dword [0x43e3bc]
mov edx, dword [eax + 0xc]
mov ecx, 0x43e3bc
mov dword [esp + 0x30], 1
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
cmp eax, ebx
mov dword [esp + 0x30], 2
jl 0x414966
cmp eax, dword [esi + 0x340]
jge 0x414966
mov ecx, dword [esi + 0x33c]
lea eax, [eax + eax*2]
lea esi, [ecx + eax*8]
push esi
lea ecx, [esp + 0x14]
call fcn.00412ba0
lea edx, [esi + 0xc]
push edx
lea ecx, [esp + 0x20]
call fcn.004072a0
mov eax, dword [esi + 0x10]
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x1c]
jmp 0x414982
push 0x433830
lea ecx, [esp + 0x40]
call fcn.004045e0
mov ebx, 1
mov byte [esp + 0x30], 3
mov dword [esp + 0xc], ebx
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004052e0
mov esi, dword [esp + 0x3c]
add eax, 0x10
add esp, 4
mov dword [esi], eax
or ebx, 2
test bl, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x30], 2
je 0x4149d4
mov eax, dword [esp + 0x3c]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [esp + 0xc], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4149d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.0040a550
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 0xc
Function at 0x414bf0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x432228
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
lea esi, [ebx + ebx + 2]
cmp esi, edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ebx
jge 0x414c90
lea eax, [esi + esi*2]
lea eax, [ebp + eax*8]
lea ecx, [eax - 0x18]
push ecx
push eax
lea ecx, [esp + 0x50]
call fcn.0040cb30
test al, al
je 0x414c50
sub esi, 1
lea edx, [esi + esi*2]
lea eax, [ebx + ebx*2]
lea edi, [ebp + edx*8]
lea ebx, [ebp + eax*8]
push edi
mov ecx, ebx
call fcn.00412ba0
lea edx, [edi + 0xc]
lea ecx, [ebx + 0xc]
push edx
call fcn.004072a0
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [ebx + 0x14], ecx
mov ebx, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x2c]
jl 0x414c34
mov edi, dword [esp + 0x2c]
cmp esi, edi
jne 0x414cc3
lea edx, [edi + edi*2]
lea eax, [ebx + ebx*2]
lea esi, [ebp + edx*8 - 0x18]
lea ebx, [ebp + eax*8]
push esi
mov ecx, ebx
call fcn.00412ba0
lea edx, [esi + 0xc]
lea ecx, [ebx + 0xc]
push edx
call fcn.004072a0
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov ecx, dword [esi + 0x14]
mov dword [ebx + 0x14], ecx
lea ebx, [edi - 1]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x60]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x64]
sub esp, 0x18
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.00413de0
mov eax, dword [esp + 0x50]
push eax
push ebx
push ebp
call fcn.00414200
add esp, 0x34
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040a550
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x414dd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x432298
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
lea esi, [edi + edi + 2]
cmp esi, ebp
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], edi
jge 0x414e6e
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
lea ecx, [eax - 0x18]
push ecx
push eax
lea ecx, [esp + 0x54]
call fcn.0040dea0
test al, al
je 0x414e30
sub esi, 1
lea edx, [esi + esi*2]
lea eax, [edi + edi*2]
lea ebp, [ebx + edx*8]
lea edi, [ebx + eax*8]
push ebp
mov ecx, edi
call fcn.00412ba0
lea edx, [ebp + 0xc]
lea ecx, [edi + 0xc]
push edx
call fcn.004072a0
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov ecx, dword [ebp + 0x14]
mov dword [edi + 0x14], ecx
mov edi, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x30]
jl 0x414e15
mov ebp, dword [esp + 0x30]
cmp esi, ebp
jne 0x414ea1
lea edx, [ebp + ebp*2]
lea eax, [edi + edi*2]
lea esi, [ebx + edx*8 - 0x18]
lea edi, [ebx + eax*8]
push esi
mov ecx, edi
call fcn.00412ba0
lea edx, [esi + 0xc]
lea ecx, [edi + 0xc]
push edx
call fcn.004072a0
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x14], ecx
lea edi, [ebp - 1]
sub esp, 0x40
lea edx, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x70], esp
push edx
call fcn.0040ddc0
sub esp, 0x18
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
mov byte [esp + 0x7c], 2
call fcn.00413de0
mov ecx, dword [esp + 0x84]
push ecx
push edi
push ebx
mov byte [esp + 0x84], 1
call fcn.004142f0
add esp, 0x64
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 0
call fcn.0040a550
lea ecx, [esp + 0x4c]
call fcn.0040d8c0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x414f80
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4322c8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
lea esi, [ebx + ebx + 2]
cmp esi, edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ebx
jge 0x415020
lea eax, [esi + esi*2]
lea eax, [ebp + eax*8]
lea ecx, [eax - 0x18]
push ecx
push eax
lea ecx, [esp + 0x50]
call fcn.0040cbb0
test al, al
je 0x414fe0
sub esi, 1
lea edx, [esi + esi*2]
lea eax, [ebx + ebx*2]
lea edi, [ebp + edx*8]
lea ebx, [ebp + eax*8]
push edi
mov ecx, ebx
call fcn.00412ba0
lea edx, [edi + 0xc]
lea ecx, [ebx + 0xc]
push edx
call fcn.004072a0
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [ebx + 0x14], ecx
mov ebx, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x2c]
jl 0x414fc4
mov edi, dword [esp + 0x2c]
cmp esi, edi
jne 0x415053
lea edx, [edi + edi*2]
lea eax, [ebx + ebx*2]
lea esi, [ebp + edx*8 - 0x18]
lea ebx, [ebp + eax*8]
push esi
mov ecx, ebx
call fcn.00412ba0
lea edx, [esi + 0xc]
lea ecx, [ebx + 0xc]
push edx
call fcn.004072a0
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov ecx, dword [esi + 0x14]
mov dword [ebx + 0x14], ecx
lea ebx, [edi - 1]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x60]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x64]
sub esp, 0x18
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.00413de0
mov eax, dword [esp + 0x50]
push eax
push ebx
push ebp
call fcn.004143e0
add esp, 0x34
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040a550
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x415120
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4322f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
lea esi, [ebx + ebx + 2]
cmp esi, edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], ebx
jge 0x4151cc
jmp 0x415170
lea eax, [esi + esi*2]
lea eax, [ebp + eax*8]
lea ecx, [eax - 0x18]
push ecx
push eax
lea ecx, [esp + 0x58]
call fcn.0040cc50
test al, al
je 0x41518c
sub esi, 1
lea edx, [esi + esi*2]
lea eax, [ebx + ebx*2]
lea edi, [ebp + edx*8]
lea ebx, [ebp + eax*8]
push edi
mov ecx, ebx
call fcn.00412ba0
lea edx, [edi + 0xc]
lea ecx, [ebx + 0xc]
push edx
call fcn.004072a0
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [ebx + 0x14], ecx
mov ebx, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x34]
jl 0x415170
mov edi, dword [esp + 0x34]
cmp esi, edi
jne 0x4151ff
lea edx, [edi + edi*2]
lea eax, [ebx + ebx*2]
lea esi, [ebp + edx*8 - 0x18]
lea ebx, [ebp + eax*8]
push esi
mov ecx, ebx
call fcn.00412ba0
lea edx, [esi + 0xc]
lea ecx, [ebx + 0xc]
push edx
call fcn.004072a0
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov ecx, dword [esi + 0x14]
mov dword [ebx + 0x14], ecx
lea ebx, [edi - 1]
sub esp, 0x42c
mov edi, esp
sub esp, 0x18
mov ecx, 0x10b
lea esi, [esp + 0x494]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x47c]
mov ecx, esp
mov dword [esp + 0x45c], esp
push edx
call fcn.00413de0
mov eax, dword [esp + 0x458]
push eax
push ebx
push ebp
call fcn.004144d0
add esp, 0x450
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040a550
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x4155b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4323f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
push ebx
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.00412ba0
lea eax, [ebx + 0xc]
lea ecx, [esi + 0xc]
push eax
call fcn.004072a0
mov ecx, dword [ebx + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [ebx + 0x14]
sub esp, 0x42c
mov dword [esi + 0x14], edx
mov edi, esp
sub esp, 0x18
mov ecx, 0x10b
lea esi, [esp + 0x48c]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x474]
mov ecx, esp
mov dword [esp + 0x454], esp
push eax
call fcn.00413de0
mov ecx, dword [esp + 0x46c]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push 0
push ebx
call fcn.00415120
add esp, 0x450
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040a550
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x415980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4324e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x43e3bc]
mov edx, dword [eax + 0xc]
mov ecx, 0x43e3bc
call edx
add eax, 0x10
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x38], eax
lea eax, [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00415680
test eax, eax
mov dword [esp + 0x38], 0xffffffff
jne 0x415a0e
lea ecx, [esp + 8]
call fcn.00408760
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 0x10
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [eax], ecx
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 8]
mov dword [edx], eax
call fcn.00408760
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 0x10

Function at 0x415d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x432588
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x43e3bc]
mov edx, dword [eax + 0xc]
mov ecx, 0x43e3bc
call edx
add eax, 0x10
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x38], eax
lea eax, [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00415680
test eax, eax
je 0x415dbe
mov esi, dword [esp + 0xc]
jmp 0x415dc1
or esi, 0xffffffff
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.00408760
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x419830
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x432888
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ecx, edi
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
sub eax, edx
sub esp, 0x40
sar eax, 1
lea edx, [esp + 0x74]
lea eax, [eax + eax*2]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
mov dword [esp + 0x64], 0
lea esi, [ebx + eax*8]
call fcn.0040ddc0
lea eax, [edi - 0x18]
push eax
push esi
push ebx
call fcn.00416420
add esp, 0x4c
cmp ebx, esi
lea ebp, [esi + 0x18]
jae 0x4198db
lea ecx, [ecx]
push esi
lea edi, [esi - 0x18]
push edi
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x4198d7
push edi
push esi
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x4198d7
mov esi, edi
cmp ebx, esi
jb 0x4198b0
mov edi, dword [esp + 0x30]
cmp ebp, edi
jae 0x419905
nop
push esi
push ebp
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x419905
push ebp
push esi
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x419905
add ebp, 0x18
cmp ebp, edi
jb 0x4198e0
mov ebx, esi
mov edi, ebp
mov dword [esp + 0x14], ebx
lea ecx, [ecx]
cmp edi, dword [esp + 0x30]
jae 0x41994c
push edi
push esi
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x419943
push esi
push edi
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x41994c
mov eax, ebp
push edi
push eax
add ebp, 0x18
call fcn.00413e60
add esp, 8
add edi, 0x18
cmp edi, dword [esp + 0x30]
jb 0x419916
cmp ebx, dword [esp + 0x2c]
jbe 0x41999c
add ebx, 0xffffffe8
push esi
push ebx
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x419980
push ebx
push esi
lea ecx, [esp + 0x3c]
call fcn.0040dea0
test al, al
jne 0x419994
sub esi, 0x18
push ebx
push esi
call fcn.00413e60
add esp, 8
mov eax, dword [esp + 0x14]
sub eax, 0x18
sub ebx, 0x18
cmp dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
jb 0x419955
mov ebx, dword [esp + 0x14]
cmp ebx, dword [esp + 0x2c]
jne 0x4199ce
cmp edi, dword [esp + 0x30]
je 0x419a10
cmp ebp, edi
je 0x4199b2
push ebp
push esi
call fcn.00413e60
add esp, 8
mov eax, edi
mov ecx, esi
push eax
push ecx
add ebp, 0x18
add esi, 0x18
add edi, 0x18
call fcn.00413e60
add esp, 8
jmp 0x419910
sub ebx, 0x18
cmp edi, dword [esp + 0x30]
mov dword [esp + 0x14], ebx
jne 0x4199fe
sub esi, 0x18
cmp ebx, esi
je 0x4199ec
push esi
push ebx
call fcn.00413e60
add esp, 8
sub ebp, 0x18
push ebp
push esi
call fcn.00413e60
add esp, 8
jmp 0x419910
push ebx
push edi
call fcn.00413e60
add esp, 8
add edi, 0x18
jmp 0x419910
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x34]
mov dword [edi], esi
mov dword [edi + 4], ebp
call fcn.0040d8c0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x41a930
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
mov dword [esi + 0xf0], eax
mov dword [esi + 0xf4], eax
mov dword [esi + 0x94], 0
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x234]
jne 0x41a961
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x234]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41a981
mov ecx, dword [esi + 0x234]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x70], 0
je 0x41a991
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
movsx ecx, word [esp + 0x10]
imul ecx, dword [esi + 0xf8]
mov eax, 0x88888889
imul ecx
mov eax, dword [esi + 4]
add edx, ecx
sar edx, 6
mov edi, edx
push 1
shr edi, 0x1f
push eax
add edi, edx
call dword [sym.imp.USER32.dll_GetScrollPos]
mov ecx, dword [esi + 0xd0]
imul ecx, edi
sub eax, ecx
test edi, edi
jle 0x41a9d7
xor edx, edx
test eax, eax
setle dl
sub edx, 1
and eax, edx
push 0
push 0
push eax
push 1
mov ecx, esi
call fcn.0041a330
mov edx, dword [esi + 4]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x41c2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x432b08
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x43e3bc]
mov edx, dword [eax + 0xc]
mov ecx, 0x43e3bc
call edx
xor edx, edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov esi, dword [esp + 0x4c]
cmp esi, edx
mov dword [esp + 0x44], edx
jne 0x41c30c
xor eax, eax
jmp 0x41c320
mov eax, esi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, dx
jne 0x41c311
sub eax, edi
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.004039a0
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x64]
lea eax, [esp + 0x10]
mov dword [esp + 0x24], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x3c], edx
call fcn.0041b5d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0xffffffff
call fcn.00407d80
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret 0x1c

Function at 0x41c390
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x94], 0
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x234]
jne 0x41c3b4
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x234]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c3d4
mov ecx, dword [esi + 0x234]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esi + 4]
movzx edx, di
movzx eax, bx
shl edx, 0x10
or edx, eax
push edx
push 0
push 0x201
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push eax
push edi
push ebx
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.00411830
test eax, eax
je 0x41c433
test byte [esp + 0x18], 1
je 0x41c433
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0041ba90
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push eax
push edi
push ebx
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
call fcn.00412280
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
push 0xfffffa20
push ecx
push edx
mov ecx, esi
call fcn.00410dc0
pop edi
pop esi
pop ebx
pop ecx
ret 0xc