joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3ab2fadb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x234
mov eax, 0x3ab43874
call fcn.3ab359d8
mov esi, dword [ebp + 8]
mov ebx, ecx
xor edi, edi
push 0x3aa5baac
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x23c], edi
call fcn.3ab3c1f6
mov dword [ebp - 4], edi
push 0xffffffffffffffff
push edi
push esi
lea ecx, [ebp - 0x238]
call fcn.3ab3c1f6
push 0x3aa5ba8c
lea ecx, [ebp - 0x238]
call fcn.3ab3c1f6
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x3ab2fb3e
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x23c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x3ab2fbcb
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.3ab033f0
add esp, 0xc
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push edi
push dword [ebp - 0x23c]
mov dword [ebp - 0x240], 0x20a
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x3ab2fbcb
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.3ab3c1f6
pop ecx
pop ecx
cmp eax, edi
je 0x3ab2fbcb
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebx + 0x44]
call fcn.3ab3c1f6
cmp dword [ebp - 0x23c], edi
je 0x3ab2fbe1
lea eax, [ebp - 0x23c]
push eax
mov ecx, ebx
call fcn.3ab3c1f6
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x238]
call fcn.3ab3c1f6
call fcn.3ab35a6a
ret 4
Function at 0x3ab340cb
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x10
mov eax, 0x3ab44225
call fcn.3ab35965
mov esi, ecx
mov dword [ebp - 0x18], esi
call fcn.3aa95baf
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 0x1c]
call fcn.3aa95baf
mov byte [ebp - 4], 1
lea ebx, [esi + 0x38]
mov eax, ebx
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov byte [ebp - 4], 3
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 7
lea eax, [ebp - 0x10]
push eax
push 0x3aa5cfcc
push 1
push edi
push 0x3aa5d09c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jge 0x3ab34166
push 0x1c
call fcn.3ab3c1f6
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
cmp ecx, edi
je 0x3ab3414f
push 0x3aa5ceb8
call fcn.3ab336e3
jmp 0x3ab34151
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp + 8], eax
push 0x3ab56f28
lea eax, [ebp + 8]
push eax
call fcn.3ab3c1f6
push 0x3aa80c64
mov ecx, esi
call fcn.3ab3c1f6
push dword [ebp + 8]
mov ecx, esi
call fcn.3ab3c1f6
cmp dword [esi + 0x18], 8
jb 0x3ab34187
mov eax, dword [esi + 4]
jmp 0x3ab3418a
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 8]
call fcn.3ab3c1f6
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
mov ebx, eax
cmp dword [ebp - 0x10], edi
je 0x3ab341bb
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.3ab3c1f6
cmp ebx, edi
jge 0x3ab341f6
push 0x1c
call fcn.3ab3c1f6
pop ecx
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 0xa
cmp ecx, edi
je 0x3ab341e0
push 0x3aa5ce74
call fcn.3ab336e3
jmp 0x3ab341e2
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x14], eax
push 0x3ab56f28
lea eax, [ebp - 0x14]
jmp 0x3ab34160
mov byte [ebp - 4], 7
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
call fcn.3ab2e830
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.3ab35a51
ret 4

Function at 0x3ab3c1f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x3ab3c205
pop dword [ebp - 0x4c]
mov eax, 0xb9a485d1
add eax, 0x810f3c34
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x7347e
push 0
mov eax, 0x35ee7dcb
add eax, 0x4b69511
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xda412078
add ecx, 0x25bf271c
xor ebx, ebx
add ebx, eax
mov edx, 0x3aba1800
add edx, dword [ebp - 0x4c]
mov edi, 0xf73e3a89
add edi, 0x29a779ea
mov dword [ebp - 0x48], 0xb76212e0
mov esi, dword [edx]
xor dword [ebp - 0x44], edx
xor esi, edi
xor dword [ebp - 0x40], ebx
mov dword [ebx], esi
sub dword [ebp - 0x14], 0x90dc3324
add ebx, 4
add edx, 0x936988e1
add edx, 0x6c967723
loop 0x3ab3c260
add eax, 0xe4c1f7ce
add eax, 0x1b3f1955
mov ebx, eax
add eax, 0xfe2d8737
add eax, 0x1d278ce
mov ecx, 0x3aa50000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x406b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406b49

Function at 0x414828
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x414876
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x414850
cmp edx, 1
je 0x414897
cmp edx, 2
je 0x41488e
cmp edx, 3
jne 0x4148a2
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x420fc0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
lea ecx, [esi + 0x50]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x4318d0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x29]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.0042e87a
add esp, 0x10
mov dword [esi + 4], esp
lea eax, [esi + 0x18]
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov byte [eax + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d2f0
add esp, 4
lea eax, [esi + 0x18]
mov dword [edi], eax
mov dword [edi + 4], 0xd
lea eax, [esi + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004348be
add esp, 0x1c
mov esp, dword [esi + 4]
add eax, esi
add eax, 0x18
mov dword [esi + 4], eax
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.00421d3a
add esp, 0xc
mov dword [esi + 0x14], eax
lea edi, [esi + 0x30]
mov dword [edi + 0x13], ebx
mov dword [edi + 0xf], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea eax, [esi + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0xc]
mov dword [eax], ebx
lea ebx, [esi + 8]
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0041931a
lea eax, [esi + 0x50]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
push edi
push dword [esi + 4]
push dword [esi + 0x14]
lea eax, [esi + 0x18]
push eax
call fcn.00422f30
add esp, 0x1c
mov ebx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
test eax, eax
jne 0x4210f6
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x58], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x58], 0xffffffff
movsx edx, dl
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00413d41
add esp, 0x1c
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x421390
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
lea ecx, [esi + 0x50]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x4318f0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x29]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edi + 4]
push edx
push ecx
push eax
call fcn.0042e87a
add esp, 0x10
mov dword [esi + 4], esp
lea eax, [esi + 0x18]
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov byte [eax + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d2f0
add esp, 4
lea eax, [esi + 0x18]
mov dword [edi], eax
mov dword [edi + 4], 0xd
lea eax, [esi + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004348be
add esp, 0x1c
mov esp, dword [esi + 4]
add eax, esi
add eax, 0x18
mov dword [esi + 4], eax
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.00421d3a
add esp, 0xc
mov dword [esi + 0x14], eax
lea edi, [esi + 0x30]
mov dword [edi + 0x13], ebx
mov dword [edi + 0xf], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea eax, [esi + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0xc]
mov dword [eax], ebx
lea ebx, [esi + 8]
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0041931a
lea eax, [esi + 0x50]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
push edi
push dword [esi + 4]
push dword [esi + 0x14]
lea eax, [esi + 0x18]
push eax
call fcn.00422f30
add esp, 0x1c
mov ebx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
test eax, eax
jne 0x4214c5
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x58], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x58], 0xffffffff
movsx edx, dl
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00413d41
add esp, 0x1c
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x421ba0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0xc], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x431c30
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea ebx, [esi + 0x50]
mov dword [ebx + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
push eax
sub esp, 0x18
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d2f0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x14
mov dword [edi + 0x14], 0x4aa2b7
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004348be
add esp, 0x1c
mov esp, dword [esi + 0xc]
mov dword [esi + 0xc], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
push eax
push ebx
call fcn.00421d3a
add esp, 0xc
mov dword [esi + 0x18], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 0x10]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.0041931a
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
mov ecx, edi
push 0x4bdf30
call fcn.0042c9d8
mov ebx, eax
mov edi, dword [esi + 0x10]
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x421c99
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x78], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [esi + 0x14]
mov eax, dword [ebx]
mov edi, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
lea eax, [esi + 0x20]
mov ecx, ebx
push eax
mov ebx, dword [esi + 0x1c]
push ebx
lea eax, [esi + 0x50]
push eax
call edi
mov ecx, dword [esi + 0x18]
mov eax, ecx
lea edx, [esi + 0x50]
sub eax, edx
cmp ecx, ebx
mov ecx, dword [esi + 0xc]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00413d41
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x421fb0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x431920
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.0042e87a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d2f0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004348be
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.00421d3a
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041931a
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004237a0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4220eb
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00422db0
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x422190
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x431930
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.0042e87a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d2f0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004348be
add esp, 0x20
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.00421d3a
add esp, 0xc
mov dword [esi + 8], eax
lea ebx, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x4a], xmm0
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041931a
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004237a0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4222ee
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00422db0
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x4223a0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x431940
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.0042e87a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d2f0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004348be
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.00421d3a
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041931a
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004237a0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4224da
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00422db0
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x422580
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x431950
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.0042e87a
add esp, 0x10
mov dword [esi + 8], esp
lea eax, [esi + 0x20]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [eax], xmm0
mov ebx, eax
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d2f0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004348be
add esp, 0x20
mov esp, dword [esi + 8]
lea ebx, [esi + eax]
add ebx, 0x20
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0x20]
push eax
call fcn.00421d3a
add esp, 0xc
mov dword [esi + 8], eax
lea edi, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x4a], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041931a
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push edi
push ebx
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004237a0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4226e2
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00422db0
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c