joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a1ad40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
test dword [eax + 0x68], 0x100
jne 0x1a1ad7b
mov eax, dword fs:[0x30]
test dword [eax + 0x68], 0x2000000
jne 0x1a1ad7b
cmp dword [0x1ac6698], 0
jne 0x1a580e0
test byte [0x1ac8728], 3
jne 0x1a580e0
pop edi
pop esi
pop ebx
ret
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push 3
mov dword [0x1ac8844], edi
call fcn.019dd2b0
mov dword [0x1ac65e0], eax
test eax, eax
je 0x1a1ad7b
mov esi, dword fs:[0x30]
mov ebx, 0x19b4dbc
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], edi
je 0x1a58135
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a5813b
push ebx
call fcn.019dafb0
pop ecx
push 0x19ccb18
call fcn.019dafb0
pop ecx
call fcn.01a85561
test al, al
jne 0x1a58160
push dword [0x1ac65e0]
call fcn.019dd090
jmp 0x1a1ad7b
mov ecx, dword [esi + 0x88]
mov eax, dword [esi + 0x90]
mov eax, dword [eax + ecx*4 - 4]
mov dword [0x1ac8840], eax
call fcn.01a8584f
call fcn.01a85a26
push dword [0x1ac65e0]
call fcn.019dd090
mov eax, dword fs:[0x30]
mov dword [0x1ac65e0], edi
cmp dword [0x1ac8844], edi
je 0x1a581ec
cmp dword [eax + 0xc], edi
je 0x1a581c0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a581c6
push ebx
call fcn.019dafb0
pop ecx
push dword [0x1ac8844]
push 0x19ccb44
call fcn.019dafb0
test byte [0x1ac8728], 2
pop ecx
pop ecx
je 0x1a1ad7b
int3
cmp dword [eax + 0xc], edi
je 0x1a5820e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a58214
push ebx
call fcn.019dafb0
pop ecx
push 0x19ccb5c
call fcn.019dafb0
pop ecx
jmp 0x1a1ad7b

Function at 0x1a1b440
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1a1b49d
cmp dword [ebp + 0xc], 0
jl 0x1a1b49d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a1b49d
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push dword [esi + 0x24]
call fcn.01a24280
mov edi, eax
call fcn.019f1a00
test eax, eax
jne 0x1a58411
mov ecx, 0x7ffe0386
cmp byte [ecx], 0
jne 0x1a58426
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x1a1b495
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0x50]
add ecx, 0x22c
jmp 0x1a1b48a
test edi, edi
js 0x1a1b493
mov edx, dword [ebp + 0xc]
mov ecx, esi
call fcn.01aa5f91
jmp 0x1a1b493

Function at 0x1a1bc04
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ecx
cmp ecx, dword [0x1ac86e4]
jne 0x1a585c1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a585c1
mov edx, 0x1ac86e8
mov ecx, 0x1ac86e4
call fcn.019edd22
pop ecx
ret
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a1bc35
call fcn.01aa5c15
pop ecx
ret
Function at 0x1a1ca55
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x1acd344]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x14], edx
push 0x60
pop esi
xor ecx, ecx
mov ax, word [ebx + 0x14]
push esi
mov word [esp + 0x10], ax
lea eax, [esp + 0x1c]
push ecx
mov dword [esp + 0x16], ecx
push eax
mov word [esp + 0x1e], cx
mov byte [esp + 0x1b], 1
call fcn.01a28e60
or dword [esp + 0x3c], 0xffffffff
lea edi, [esp + 0x4c]
mov dword [esp + 0x28], esi
add esp, 0xc
mov dword [esp + 0x18], 7
mov esi, 0x19bc0a8
mov eax, dword [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x30]
lea edi, [esp + 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x64], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x18]
push eax
call fcn.019db2f0
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
Function at 0x1a327d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
push dword [ebp + 0x20]
mov eax, dword [esi]
mov dword [ebp + 0x18], eax
mov eax, ebx
and al, 8
movzx eax, al
neg eax
sbb eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
dec dword [eax]
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
call fcn.01a32b9a
mov edi, dword [ebp + 0x24]
pop ecx
pop ecx
mov ecx, ebx
and ecx, 0x10
mov dword [ebp + 8], ecx
jne 0x1a3281e
dec edi
mov ecx, ebx
and ecx, 1
mov dword [ebp + 0x24], ecx
test ecx, ecx
je 0x1a3283b
mov ecx, dword [ebp + 0x1c]
mov eax, ecx
dec ecx
mov dword [ebp + 0x1c], ecx
test eax, eax
je 0x1a32961
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x20]
inc dword [eax]
call fcn.01a3340a
pop ecx
movzx ecx, ax
mov edx, 0xffff
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov word [eax], cx
cmp dx, cx
je 0x1a3294b
cmp dword [ebp + 8], 0
jne 0x1a328b9
test bl, 0x20
je 0x1a3287d
cmp ecx, 9
jb 0x1a32878
cmp ecx, 0xd
jbe 0x1a3287d
cmp ecx, 0x20
jne 0x1a328b9
test bl, 0x40
je 0x1a3294b
mov ax, cx
shr ax, 3
movzx eax, ax
cmp cx, ax
jb 0x1a3294b
xor edx, edx
and ecx, 7
inc edx
shl edx, cl
mov ecx, dword [ebp + 0xc]
movsx eax, byte [eax + ecx]
xor eax, dword [ebp - 4]
test eax, edx
je 0x1a3294b
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
test bl, 4
jne 0x1a32923
test edi, edi
je 0x1a3292f
test bl, 2
je 0x1a328d2
mov eax, dword [esi]
mov word [eax], cx
add dword [esi], 2
dec edi
jmp 0x1a32927
mov al, byte [eax]
cmp edi, dword [0x1ac5854]
jb 0x1a328e7
mov ecx, dword [esi]
mov byte [ecx], al
mov eax, dword [esi]
movsx eax, byte [eax]
jmp 0x1a3290f
mov byte [ebp - 0x10], al
movsx eax, al
mov dword [ebp - 8], eax
test eax, eax
jle 0x1a328f8
cmp eax, edi
ja 0x1a3292f
cmp eax, 5
ja 0x1a3292f
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call fcn.01a287e0
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp + 0x24]
test eax, eax
jle 0x1a32826
add dword [esi], eax
sub edi, eax
jmp 0x1a32826
add dword [ebp + 0x18], 2
mov ecx, dword [ebp + 0x24]
jmp 0x1a32826
mov eax, dword [ebp + 0x18]
test bl, 2
je 0x1a32946
xor ecx, ecx
mov word [eax], cx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
jmp 0x1a3293c
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x20]
dec dword [eax]
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
call fcn.01a32b9a
pop ecx
pop ecx
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi]
je 0x1a3293c
test bl, 4
jne 0x1a32989
mov eax, dword [ebp + 0x28]
inc dword [eax]
cmp dword [ebp + 8], 0
jne 0x1a32989
mov eax, dword [esi]
test bl, 2
je 0x1a32986
xor ecx, ecx
mov word [eax], cx
jmp 0x1a32989
mov byte [eax], 0
xor eax, eax
jmp 0x1a3293f
Function at 0x1a5a119
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
push 0x3d
push esi
mov dword [ebp - 0x14], edi
call fcn.01a2a580
pop ecx
pop ecx
test eax, eax
je 0x1a5a28e
xor ecx, ecx
mov word [eax], cx
movzx ecx, word [esi]
cmp ecx, 0x53
jne 0x1a5a15f
add eax, 2
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.01a24f40
xor bl, bl
jmp 0x1a5a187
cmp ecx, 0x4f
jne 0x1a5a28e
push 0x10
lea ecx, [ebp - 0x1c]
add eax, 2
push ecx
push eax
call fcn.01a2ab40
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je 0x1a5a28e
mov bl, 1
mov ecx, edi
call fcn.01a5a2fa
mov edi, eax
test edi, edi
je 0x1a5a28e
movzx esi, word [edi + 0x14]
xor eax, eax
add esi, 0x18
xor ecx, ecx
add esi, edi
cmp ax, word [edi + 6]
mov dword [ebp - 4], ecx
jae 0x1a5a28a
cmp dword [esi + 0xc], 0
push 8
pop edx
je 0x1a5a27b
cmp dword [esi + 8], 0
je 0x1a5a27b
test bl, bl
jne 0x1a5a21a
xor ecx, ecx
mov dword [ebp - 0x20], esi
mov word [ebp - 0x22], dx
mov word [ebp - 0x24], cx
movzx eax, cx
cmp byte [eax + esi], 0
je 0x1a5a1ee
inc cx
mov word [ebp - 0x24], cx
cmp cx, dx
jb 0x1a5a1da
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.019ef750
test eax, eax
js 0x1a5a28e
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.019ff2e0
test eax, eax
je 0x1a5a222
jmp 0x1a5a26f
lea eax, [ecx + 1]
cmp dword [ebp - 8], eax
jne 0x1a5a26b
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
call fcn.01a22e60
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
push 0x19bcb48
push 3
push 0x55
call fcn.019d5380
add esp, 0x1c
test bl, bl
jne 0x1a5a28a
mov ecx, dword [ebp - 4]
test bl, bl
jne 0x1a5a27b
lea eax, [ebp - 0x2c]
push eax
call fcn.019f1410
mov ecx, dword [ebp - 4]
movzx eax, word [edi + 6]
inc ecx
add esi, 0x28
cmp ecx, eax
jmp 0x1a5a1a9
mov al, 1
jmp 0x1a5a290
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1a5a2fa
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1ab04b8
call fcn.01a3611c
xor edx, edx
test ecx, ecx
je 0x1a5a356
cmp ecx, 0xffffffff
je 0x1a5a356
mov dword [ebp - 4], edx
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1a5a34f
mov eax, dword [ecx + 0x3c]
test eax, eax
js 0x1a5a34f
cmp eax, 0x10000000
jae 0x1a5a34f
add eax, ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [eax]
sub edx, 0x4550
neg edx
sbb edx, edx
not edx
and edx, eax
jmp 0x1a5a34c
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
call fcn.01a36161
ret
Function at 0x1a5d713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x1acd344]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push dword [0x1ac7bb8]
mov edi, dword [ebp + 8]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebx
call fcn.01a12b10
mov esi, eax
lea eax, [esp + 0x18]
test esi, esi
je 0x1a5d762
push eax
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x1a5d76d
push 0x19b4bee
push eax
call fcn.01a8c450
cmp eax, 0xffffffff
je 0x1a5d840
lea eax, [esp + 0x10]
xor esi, esi
push eax
push esi
push esi
push 0x19bc920
call fcn.01a02510
test eax, eax
jne 0x1a5d80a
mov eax, dword fs:[0x30]
push 2
mov edx, dword [eax + 0x10]
mov ax, word [edx + 0x38]
and dword [esp + 0x80], 0
shr ax, 1
mov word [esp + 0x10], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x78], esi
pop esi
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], esi
mov eax, dword [edx + 0x3c]
movzx ecx, word [edx + 0x38]
and dword [esp + 0x84], 0
and dword [esp + 0x8c], 0
mov dword [esp + 0x80], eax
lea eax, [esp + 0x70]
push eax
push esi
push 0x19bc8f0
push dword [esp + 0x20]
mov dword [esp + 0x98], ecx
push dword [esp + 0x20]
call fcn.01a0fef0
xor esi, esi
push esi
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.01a08380
mov eax, dword [ebx + 0xb8]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 4]
or eax, 1
mov dword [esp + 0x20], 0xc000041d
push esi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push ebx
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], esi
call fcn.01a23ef0
push eax
call fcn.01a36fb0
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 8

Function at 0x1a5e812
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
xor ecx, ecx
mov dword [0x1ac861c], ecx
mov dword [0x1ac8620], ecx
mov byte [eax], cl
cmp byte [eax + 2], cl
je 0x1a5e832
call fcn.01a5e7d0
xor eax, eax
ret
Function at 0x1a5f4a6
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 4
push 0x19b80a0
mov edi, dword [ebx + 4]
push edi
call fcn.01a2a6d0
add esp, 0xc
test eax, eax
jne 0x1a5f618
mov esi, 0x7ffe0030
add edi, 8
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x1a5f4e8
sub esi, ecx
sar esi, 1
push esi
push 0x7ffe0030
push edi
call fcn.01a279e0
add esp, 0xc
test eax, eax
jne 0x1a5f618
push 0xa
lea edi, [edi + esi*2]
push 0x19bdea8
push edi
call fcn.01a279e0
add esp, 0xc
xor esi, esi
test eax, eax
jne 0x1a5f52a
inc esi
jmp 0x1a5f542
push 0xa
push 0x19bdec0
push edi
call fcn.01a279e0
add esp, 0xc
test eax, eax
jne 0x1a5f618
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 0x1000000
mov dword [ebp - 0x10c], eax
lea ecx, [ebp - 0x110]
xor eax, eax
mov edx, ebx
mov word [ebp - 0x108], ax
call fcn.019edf44
test eax, eax
js 0x1a5f61a
neg esi
lea eax, [ebp - 0x110]
push 1
sbb esi, esi
mov edi, 0x3a64
and esi, 0xfffffeb5
add esi, 0x14c
push edi
movzx esi, si
push esi
push eax
call fcn.01a15f50
xor ecx, ecx
mov dword [ebp - 0x150], 0x18
push 0x40
mov dword [ebp - 0x14c], ecx
pop eax
cmp byte [0x1ac7bd4], cl
jne 0x1a5f5c0
mov eax, 0x840
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x140], ecx
push eax
mov dword [ebp - 0x13c], ecx
call fcn.01a22d30
test eax, eax
js 0x1a5f5ff
push 1
push edi
push esi
push ebx
call fcn.01a15f50
lea eax, [ebp - 0x108]
cmp eax, dword [ebp - 0x10c]
je 0x1a5f618
push dword [ebp - 0x10c]
call fcn.019d7800
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret

Function at 0x1a5faf0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
push ebx
add edx, eax
xor ebx, ebx
movzx eax, word [ecx + 6]
mov dword [ebp - 4], eax
push esi
mov esi, ebx
push edi
mov edi, dword [ecx + 0x28]
test eax, eax
je 0x1a5fb3e
mov eax, dword [edx + 8]
test eax, eax
je 0x1a5fb28
mov ecx, dword [edx + 0xc]
cmp edi, ecx
jb 0x1a5fb28
add eax, ecx
cmp edi, eax
jb 0x1a5fb33
add edx, 0x28
inc esi
cmp esi, dword [ebp - 4]
jb 0x1a5fb14
jmp 0x1a5fb3e
test dword [edx + 0x24], 0x20000000
je 0x1a5fb3e
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1a63fac
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
jne 0x1a63fc1
cmp byte [0x7ffe02d4], 0
je 0x1a63fd9
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x68]
mov eax, dword fs:[0x30]
or ecx, 0x10000
mov dword [eax + 0x68], ecx
mov al, 1
ret
Function at 0x1a68110
Capabilities:
Get process heap flags

Disassembly:
push 0x68
push 0x1ab07a0
call fcn.01a36178
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
movzx eax, byte [0x1ac58c0]
shr eax, 2
and eax, 1
je 0x1a682d2
push dword [ebx + 4]
call fcn.01a167c0
test eax, eax
je 0x1a682d2
cmp eax, 3
je 0x1a682d2
cmp eax, 5
je 0x1a682d2
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0x5c]
push eax
push edi
push ebx
xor dl, dl
xor cl, cl
call fcn.019f3420
mov esi, eax
test esi, esi
js 0x1a681b5
mov dword [ebp - 0x74], 0x18
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], 0x40
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.01a22d30
mov esi, eax
push dword [ebp - 0x58]
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f1440
mov eax, esi
not eax
test eax, eax
js 0x1a681c4
mov eax, esi
jmp 0x1a682d7
movzx eax, word [ebx]
add eax, 0xa
push eax
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
jne 0x1a681ed
mov eax, 0xc0000017
jmp 0x1a682d7
movzx eax, word [ebx]
push eax
push dword [ebx + 4]
lea eax, [esi + 0xa]
push eax
call fcn.01a287e0
add esp, 0xc
mov ax, word [ebx]
mov word [esi + 8], ax
push 0x1ac8630
call fcn.019f6460
mov dword [ebp - 4], edi
movzx ecx, word [ebx]
movzx eax, word [0x1ac5740]
add eax, 2
add eax, ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xfffe
jbe 0x1a6824a
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1acd344
call fcn.01a26e10
add esp, 0xc
mov eax, 0xc0000106
jmp 0x1a682d7
mov word [0x1ac5740], ax
mov eax, dword [0x1ac5738]
mov ecx, 0x1ac5738
cmp dword [eax + 4], ecx
je 0x1a68264
push 3
pop ecx
int 0x29
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
mov dword [0x1ac5738], esi
mov dword [ebp - 4], 0xfffffffe
mov ebx, dword [ebp - 0x50]
call fcn.01a682c7
push 0x1ac8628
call fcn.019f6460
mov ecx, 0x1ac6e48
call fcn.01a13522
mov dword [ebp - 0x4c], eax
push 0x1ac8628
call fcn.019f8f20
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x1a682b9
push eax
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f1440
mov dword [ebx], esi
xor eax, eax
jmp 0x1a682d7
mov eax, 0xc000000d
call fcn.01a361c0
ret 8
Function at 0x1a6aee9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
push ebx
push esi
movzx esi, word [ebp + 8]
push edi
push esi
push 8
push dword [eax + 0x18]
mov dword [ebp - 8], edx
mov edi, ecx
call fcn.019f3940
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x1a6b02f
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 2
push edi
push 0xffffffffffffffff
call fcn.01a22b90
mov edi, eax
test edi, edi
js 0x1a6af7e
mov ecx, dword [ebx + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x1a6af39
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0xc], ecx
cmp ecx, esi
jae 0x1a6b025
mov esi, dword [ebp - 8]
push ecx
push dword [ebx + 4]
push esi
call fcn.01a287e0
push 0x5c
push esi
call fcn.01a2a7e0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1a6af9f
mov edi, 0xc0000039
xor eax, eax
test ebx, ebx
je 0x1a6af94
push ebx
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f1440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
add esi, 2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x1a6afa7
sub ecx, edx
sar ecx, 1
add ecx, ecx
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
je 0x1a6affa
lea eax, [ecx + 2]
push eax
mov eax, dword fs:[0x30]
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x1a6afe6
mov edi, 0xc0000017
jmp 0x1a6af7e
mov ecx, dword [ebp - 4]
add ecx, 2
push ecx
push esi
push eax
call fcn.01a287e0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1a6b003
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1a6b012
sub esi, dword [ebp - 8]
and esi, 0xfffffffe
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1a6af7e
mov byte [eax], 1
jmp 0x1a6af7e
mov edi, 0x80000005
jmp 0x1a6af7e
mov edi, 0xc0000017
jmp 0x1a6af80
Function at 0x1a6ce1b
Capabilities:
Get process heap flags

Disassembly:
push 0x6c
push 0x1ab0860
call fcn.01a36178
mov esi, ecx
push 0x3a
pop ecx
mov word [ebp - 0x50], cx
push 0x3c
pop eax
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x4c], 0x19c1edc
push 0x38
pop eax
mov word [ebp - 0x58], ax
mov word [ebp - 0x56], cx
mov dword [ebp - 0x54], 0x19c1f18
call fcn.019f1a00
test eax, eax
je 0x1a6ce6a
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x50]
add ecx, 0x22b
jmp 0x1a6ce6f
mov ecx, 0x7ffe0385
test byte [ecx], 1
je 0x1a6cea1
call fcn.019f1a00
mov ebx, 0x7ffe0384
test eax, eax
je 0x1a6ce92
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22a
jmp 0x1a6ce94
mov eax, ebx
movzx edx, byte [eax]
lea ecx, [ebp - 0x50]
call fcn.01a6b2a0
jmp 0x1a6cea6
mov ebx, 0x7ffe0384
test esi, esi
jne 0x1a6ceb4
mov edi, 0xc000000d
jmp 0x1a6cf68
xor edi, edi
mov dword [ebp - 4], edi
push esi
call fcn.01a167c0
mov dword [ebp - 0x7c], eax
mov dword [ebp - 4], 0xfffffffe
cmp eax, 1
je 0x1a6ced8
cmp eax, 2
je 0x1a6ced8
cmp eax, 6
jne 0x1a6ceaa
push edi
push edi
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.01a05b70
test al, al
jne 0x1a6ceef
mov edi, 0xc000003a
jmp 0x1a6cf68
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x78], 0x18
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x6c], 0x40
lea eax, [ebp - 0x60]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.01a22d30
mov edi, eax
push esi
push 0
mov ecx, dword fs:[0x30]
push dword [ecx + 0x18]
call fcn.019f1440
test edi, edi
js 0x1a6cf68
mov al, byte [ebp - 0x24]
and al, 0x10
movzx edi, al
neg edi
sbb edi, edi
and edi, 0xc000000d
jmp 0x1a6cf68
mov esi, 0x7ffe0385
call fcn.019f1a00
test eax, eax
je 0x1a6cf85
mov eax, dword fs:[0x30]
mov esi, dword [eax + 0x50]
add esi, 0x22b
test byte [esi], 1
je 0x1a6cfad
call fcn.019f1a00
test eax, eax
je 0x1a6cfa2
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0x50]
add ebx, 0x22a
movzx edx, byte [ebx]
lea ecx, [ebp - 0x58]
call fcn.01a6b2a0
mov eax, edi
call fcn.01a361c0
ret
Function at 0x1a6f620
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
je 0x1a6f640
cmp ebx, 2
je 0x1a6f640
mov eax, 0xc000000d
jmp 0x1a6f7ac
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x24]
push esi
push edi
movzx ecx, word [eax]
add edx, 3
mov eax, dword [ebp + 0x18]
add ecx, 3
mov edi, dword [ebp + 8]
push 0xfffffffffffffffc
pop esi
movzx eax, word [eax]
and ecx, esi
add eax, 3
and edx, esi
and eax, esi
mov dword [ebp - 0xc], edx
add eax, 0x2b
add ecx, edx
add ecx, eax
and ecx, esi
mov esi, dword [edi + 0xc]
mov dword [ebp - 8], ecx
mov eax, dword [esi + 8]
add eax, ecx
cmp eax, ecx
jb 0x1a6f6a5
mov esi, dword [esi + 4]
cmp eax, esi
jbe 0x1a6f6db
add esi, esi
cmp esi, eax
jb 0x1a6f688
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call fcn.019f3940
mov ebx, eax
test ebx, ebx
jne 0x1a6f6af
mov eax, 0xc0000017
jmp 0x1a6f7aa
mov eax, dword [edi + 0xc]
push dword [eax + 8]
push eax
push ebx
call fcn.01a287e0
mov eax, dword fs:[0x30]
add esp, 0xc
push dword [edi + 0xc]
push 0
push dword [eax + 0x18]
call fcn.019f1440
mov dword [edi + 0xc], ebx
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
add ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov eax, dword [edx]
mov dword [ecx + 8], eax
mov eax, dword [edx + 4]
mov dword [ecx + 0xc], eax
mov eax, dword [esi]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 4]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x18], eax
mov ecx, dword [edi + 0xc]
movzx eax, word [edx]
push eax
push dword [edx + 4]
mov esi, dword [ecx + 8]
add esi, 0x28
lea eax, [ecx + esi]
push eax
call fcn.01a28b20
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0xc], esi
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
add eax, 3
and eax, 0xfffffffc
add esi, eax
movzx eax, word [ecx]
push eax
mov eax, dword [edi + 0xc]
push dword [ecx + 4]
add eax, esi
push eax
call fcn.01a28b20
mov eax, dword [ebp - 4]
add esp, 0x18
mov dword [eax + 0x14], esi
mov eax, dword [ebp + 0x18]
movzx eax, word [eax]
add eax, 3
and eax, 0xfffffffc
add esi, eax
cmp ebx, 2
jne 0x1a6f797
push dword [ebp + 0x24]
mov eax, dword [edi + 0xc]
push dword [ebp + 0x20]
add eax, esi
push eax
call fcn.01a28b20
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [eax + 0x24], esi
add esi, dword [ebp - 0xc]
mov eax, dword [edi + 0xc]
lea ecx, [esi + 3]
and ecx, 0xfffffffc
mov dword [eax + 8], ecx
mov eax, dword [edi + 0xc]
inc dword [eax]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20