joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x56f30c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x18], edi
mov dword [esi], 0x5802e4
call fcn.004a6d40
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 1
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
call fcn.0041d800
lea ebx, [esi + 0x100]
mov ecx, ebx
mov byte [esp + 0x18], 2
call fcn.004a6d40
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
push 0x41b3c0
push 0x41d890
push 4
push 0x1290
lea eax, [esi + 0x130]
push eax
mov byte [esp + 0x2c], 3
call fcn.0052c443
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x423567
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x56f30c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x18], edi
mov dword [esi], 0x5802e4
call fcn.004a6d40
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 1
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
call fcn.0041d800
lea ebx, [esi + 0x100]
mov ecx, ebx
mov byte [esp + 0x18], 2
call fcn.004a6d40
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
push 0x41b3c0
push 0x41d890
push 4
push 0x1290
lea eax, [esi + 0x130]
push eax
mov byte [esp + 0x2c], 3
call fcn.0052c443
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x423610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56f328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x5802f4
call fcn.004a6d40
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x50], bl
mov byte [esi + 0x51], bl
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
mov byte [esi + 0x6d], bl
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov byte [esi + 0x88], bl
mov byte [esi + 0x89], bl
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x423627
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56f328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x5802f4
call fcn.004a6d40
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x50], bl
mov byte [esi + 0x51], bl
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
mov byte [esi + 0x6d], bl
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov byte [esi + 0x88], bl
mov byte [esi + 0x89], bl
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x425ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56f823
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004a6d40
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.00423140
lea ecx, [esi + 0xbc]
mov byte [esp + 0x14], 1
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
call fcn.00423140
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x128], bl
mov byte [esi + 0x129], bl
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x425ad7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56f823
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004a6d40
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.00423140
lea ecx, [esi + 0xbc]
mov byte [esp + 0x14], 1
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
call fcn.00423140
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x128], bl
mov byte [esi + 0x129], bl
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4268d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56fc65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x580394
call fcn.004a6d40
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov byte [esi + 0x78], bl
mov byte [esi + 0x79], bl
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
lea ecx, [esi + 0xac]
mov byte [esp + 0x14], 3
mov byte [esi + 0x88], bl
mov byte [esi + 0x89], bl
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
call fcn.00425530
lea ecx, [esi + 0x3dc]
mov byte [esp + 0x14], 4
call fcn.00425530
lea ecx, [esi + 0x70c]
mov byte [esp + 0x14], 5
call fcn.00425530
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4268e7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56fc65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x580394
call fcn.004a6d40
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov byte [esi + 0x78], bl
mov byte [esi + 0x79], bl
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
lea ecx, [esi + 0xac]
mov byte [esp + 0x14], 3
mov byte [esi + 0x88], bl
mov byte [esi + 0x89], bl
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
call fcn.00425530
lea ecx, [esi + 0x3dc]
mov byte [esp + 0x14], 4
call fcn.00425530
lea ecx, [esi + 0x70c]
mov byte [esp + 0x14], 5
call fcn.00425530
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x427390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56f328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x5803c4
call fcn.004a6d40
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4273a7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56f328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x5803c4
call fcn.004a6d40
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x42cd40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esi + 0x60]
push edi
mov edi, dword [esi + 0x80]
push 0x26
mov ecx, ebx
call fcn.00495ea0
test al, al
je 0x42cd72
mov ecx, dword [esi + 0x74]
dec edi
mov eax, edi
shl eax, 4
add eax, ecx
cmp dword [eax], 0xffffffff
jne 0x42cdbb
dec edi
sub eax, 0x10
jmp 0x42cd67
push 0x28
mov ecx, ebx
call fcn.00495ea0
test al, al
je 0x42ce4d
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x74]
sub eax, ecx
inc edi
sar eax, 4
cmp edi, eax
jae 0x42ce4d
mov eax, edi
shl eax, 4
add eax, ecx
mov edi, edi
cmp dword [eax], 0xffffffff
jne 0x42cdbb
mov edx, dword [esi + 0x78]
sub edx, dword [esi + 0x74]
inc edi
sar edx, 4
add eax, 0x10
cmp edi, edx
jb 0x42cda0
jmp 0x42ce4d
mov eax, dword [esi + 0x80]
cmp eax, 0xffffffff
jne 0x42cdf3
mov edx, dword [esi + 0x78]
sub edx, dword [esi + 0x74]
sar edx, 4
xor edi, edi
xor eax, eax
test edx, edx
jbe 0x42ce30
cmp dword [ecx], 0xffffffff
jne 0x42cdef
mov edx, dword [esi + 0x78]
sub edx, dword [esi + 0x74]
inc eax
sar edx, 4
add ecx, 0x10
cmp eax, edx
jb 0x42cdd7
jmp 0x42ce30
mov edi, eax
jmp 0x42ce30
cmp eax, edi
je 0x42ce4d
test edi, edi
jge 0x42cdff
xor edi, edi
jmp 0x42ce19
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 0x74]
sub ecx, edx
sar ecx, 4
cmp edi, ecx
jb 0x42ce19
mov edi, dword [esi + 0x78]
mov ebp, edx
sub edi, ebp
sar edi, 4
dec edi
mov edx, dword [esi + 0x68]
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, edx
call fcn.004f3360
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [esi + 0x68]
lea ecx, [edi + edi*2]
shl ecx, 4
add ecx, eax
call fcn.004f3360
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 0x80], edi
cmp dword [esi + 0x80], 0xffffffff
je 0x42ce7d
push 0xd
mov ecx, ebx
call fcn.00495ea0
test al, al
je 0x42ce7d
mov ecx, dword [esi + 0x80]
mov edx, dword [esi + 0x74]
shl ecx, 4
mov eax, dword [ecx + edx]
pop edi
mov dword [esi + 0x84], eax
pop esi
pop ebp
pop ebx
ret
pop edi
lea ecx, [esi + 0x20]
pop esi
pop ebp
pop ebx
jmp fcn.004b0430
Function at 0x42cd42
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esi + 0x60]
push edi
mov edi, dword [esi + 0x80]
push 0x26
mov ecx, ebx
call fcn.00495ea0
test al, al
je 0x42cd72
mov ecx, dword [esi + 0x74]
dec edi
mov eax, edi
shl eax, 4
add eax, ecx
cmp dword [eax], 0xffffffff
jne 0x42cdbb
dec edi
sub eax, 0x10
jmp 0x42cd67
push 0x28
mov ecx, ebx
call fcn.00495ea0
test al, al
je 0x42ce4d
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x74]
sub eax, ecx
inc edi
sar eax, 4
cmp edi, eax
jae 0x42ce4d
mov eax, edi
shl eax, 4
add eax, ecx
mov edi, edi
cmp dword [eax], 0xffffffff
jne 0x42cdbb
mov edx, dword [esi + 0x78]
sub edx, dword [esi + 0x74]
inc edi
sar edx, 4
add eax, 0x10
cmp edi, edx
jb 0x42cda0
jmp 0x42ce4d
mov eax, dword [esi + 0x80]
cmp eax, 0xffffffff
jne 0x42cdf3
mov edx, dword [esi + 0x78]
sub edx, dword [esi + 0x74]
sar edx, 4
xor edi, edi
xor eax, eax
test edx, edx
jbe 0x42ce30
cmp dword [ecx], 0xffffffff
jne 0x42cdef
mov edx, dword [esi + 0x78]
sub edx, dword [esi + 0x74]
inc eax
sar edx, 4
add ecx, 0x10
cmp eax, edx
jb 0x42cdd7
jmp 0x42ce30
mov edi, eax
jmp 0x42ce30
cmp eax, edi
je 0x42ce4d
test edi, edi
jge 0x42cdff
xor edi, edi
jmp 0x42ce19
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 0x74]
sub ecx, edx
sar ecx, 4
cmp edi, ecx
jb 0x42ce19
mov edi, dword [esi + 0x78]
mov ebp, edx
sub edi, ebp
sar edi, 4
dec edi
mov edx, dword [esi + 0x68]
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, edx
call fcn.004f3360
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [esi + 0x68]
lea ecx, [edi + edi*2]
shl ecx, 4
add ecx, eax
call fcn.004f3360
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 0x80], edi
cmp dword [esi + 0x80], 0xffffffff
je 0x42ce7d
push 0xd
mov ecx, ebx
call fcn.00495ea0
test al, al
je 0x42ce7d
mov ecx, dword [esi + 0x80]
mov edx, dword [esi + 0x74]
shl ecx, 4
mov eax, dword [ecx + edx]
pop edi
mov dword [esi + 0x84], eax
pop esi
pop ebp
pop ebx
ret
pop edi
lea ecx, [esi + 0x20]
pop esi
pop ebp
pop ebx
jmp fcn.004b0430
Function at 0x42e180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x570613
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x74]
push edi
mov edi, dword [esi + 0x78]
sub edi, eax
sub esp, 0x30
sar edi, 4
mov ecx, esp
mov dword [esp + 0x44], esi
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], esp
call fcn.004b1130
lea ecx, [esi + 0x68]
push edi
call fcn.0042dd90
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x20], ebx
jle 0x42e327
lea eax, [edi + edi*4]
lea ecx, [eax*4 + 0x580444]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
jmp 0x42e1f4
mov esi, dword [esp + 0x14]
mov ebp, dword [esi + 0x74]
mov eax, dword [esi + 0x68]
mov edx, dword [esp + 0x1c]
add esi, 0x68
push 0x44
lea esi, [edx + eax]
call fcn.0050f08e
add esp, 4
mov dword [esp + 0x2c], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x44], edi
je 0x42e225
mov ecx, eax
call fcn.0042d1f0
mov edi, eax
mov ecx, dword [ebx + ebp]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, dword [esp + 0x18]
add eax, 0x88
push eax
lea ecx, [ebx + ebp + 4]
push ecx
mov ecx, edi
mov dword [esp + 0x50], 0xffffffff
call fcn.0042dcb0
mov byte [esp + 0x24], 0
mov edx, dword [esp + 0x24]
push edx
push edi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], edi
call fcn.0042d020
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x48], 1
call fcn.004b1150
mov ecx, dword [esp + 0x34]
test ecx, ecx
mov dword [esp + 0x44], 0xffffffff
je 0x42e299
call fcn.004016a0
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push edx
push 0x140
mov ecx, esi
call fcn.004b0c40
mov edi, dword [esp + 0x20]
push edi
mov ecx, esi
call fcn.004b0bd0
cmp dword [ebx + ebp], 0xffffffff
jne 0x42e2c9
push 1
push 0
mov ecx, esi
call fcn.004b0b90
mov ecx, dword [esp + 0x14]
push esi
push edi
add ecx, 0x20
call fcn.004b0b30
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
inc edi
add esi, 4
add ecx, 0x30
add ebx, 0x10
cmp edi, eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ecx
jl 0x42e1f0
mov eax, dword [esp + 0x14]
or ecx, 0xffffffff
mov dword [eax + 0x84], ecx
mov dword [eax + 0x80], ecx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x3c]
or eax, 0xffffffff
mov dword [esi + 0x84], eax
mov dword [esi + 0x80], eax
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430c80
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5707a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
lea ecx, [esi + 0x2c]
lea ebp, [eax + 8]
lea ebx, [eax + 0x4fc]
call fcn.00411130
mov eax, dword [esi + 4]
add eax, 8
lea edi, [esi + 0x20f8]
push eax
mov ecx, edi
call fcn.00445200
push 0x1ae
push 0x140
mov ecx, edi
call fcn.00444390
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call fcn.0040eb60
push 0x18
push 0xc
push eax
mov ecx, edi
mov dword [esp + 0x3c], 0
call fcn.00444a70
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
sub eax, ecx
test ecx, ecx
mov dword [esp + 0x30], 0xffffffff
je 0x430d29
cmp eax, 0x80
jbe 0x430d1f
push ecx
call fcn.0052b8dd
add esp, 4
jmp 0x430d29
push eax
push ecx
call fcn.0050e390
add esp, 8
mov ecx, ebx
call fcn.0040e480
push eax
mov ecx, edi
call fcn.0040e620
mov ecx, ebx
call fcn.0040e4a0
push eax
mov ecx, edi
call fcn.0040e630
push 0x18
push 0xc
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call fcn.00490070
mov ecx, dword [esi + 4]
lea edx, [ecx + 0x114]
push eax
add ecx, 0x1bc
push edx
push ecx
lea ecx, [esi + 0x2190]
mov dword [esp + 0x3c], 1
call fcn.0042db30
mov ecx, dword [esp + 0x18]
test ecx, ecx
mov dword [esp + 0x30], 0xffffffff
je 0x430d93
call fcn.004016a0
mov eax, dword [esi + 4]
lea ecx, [eax + 0x3c8]
push ecx
lea edx, [eax + 0x114]
push edx
add eax, 0x1bc
push eax
lea ecx, [esi + 0x2220]
call fcn.00444130
mov eax, dword [esi + 4]
add eax, 0x2d0
push eax
sub esp, 8
mov eax, esp
mov dword [esp + 0x1c], esp
push 0x18
push 0xc
push 0
push eax
mov ecx, ebp
call fcn.00490070
mov eax, dword [esi + 4]
lea ecx, [eax + 0x114]
push ecx
add eax, 0x1bc
push eax
lea ecx, [esi + 0x2454]
call fcn.00412ff0
mov ecx, dword [esp + 0x28]
pop edi
mov dword [esi + 0x29d0], 0
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x438dd0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5712f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea eax, [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov eax, esi
mov ebp, dword [eax]
mov dword [esp + 0x18], ebp
mov ebp, dword [eax + 4]
mov dword [esp + 0x1c], ebp
mov ebp, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x13]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], edx
mov dword [eax + 8], ebp
mov dword [esp + 0x54], 0
mov dword [eax + 0xc], ecx
call fcn.00438ae0
mov eax, dword [esi + 0x20]
add esp, 0x24
test eax, eax
mov dword [esp + 0x30], 0xffffffff
je 0x438eb6
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
add edx, 4
push edx
push eax
mov ecx, esi
call fcn.00438390
mov eax, dword [esi + 0x20]
test eax, eax
je 0x438eb6
mov esi, dword [esi + 0x24]
shl esi, 2
cmp esi, 0x80
jbe 0x438eac
push eax
call fcn.0052b8dd
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push esi
push eax
call fcn.0050e390
add esp, 8
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret