joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11b1f9f
Capabilities:
Create thread
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi + 0x38], ecx
je 0x11b1fb9
mov eax, 0x80004005
jmp 0x11b216a
cmp dword [esi + 0x2c], ecx
push ebx
push edi
mov dword [ebp - 4], ecx
jle 0x11b20e3
xor ebx, ebx
mov eax, dword [esi + 0x28]
push ecx
push 0x42000000
push 3
push ecx
push 7
lea edi, [ebx + eax]
mov eax, dword [edi + 0x102c]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [edi + 0x1018]
call fcn.01082763
mov eax, dword [esi + 0x28]
lea ecx, [ebx + eax + 0x1018]
cmp dword [ecx], 0xffffffff
jne 0x11b200b
push 0
call fcn.01082763
mov eax, dword [esi + 0x28]
lea ecx, [ebx + eax]
cmp dword [ecx + 0x1018], 0
je 0x11b20c5
xor eax, eax
lea edi, [ecx + 0x1004]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esi + 0x28]
xor eax, eax
mov ecx, 0x400
add edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x28]
push 0
add eax, ebx
mov ecx, dword [eax + 0x1018]
lea edx, [eax + 0x1004]
push edx
lea edx, [eax + 0x1000]
push edx
push 0x1b
push 1
push 0x1000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
test eax, eax
mov eax, dword [esi + 0x28]
je 0x11b20bb
push 0
add eax, ebx
mov ecx, dword [eax + 0x1018]
push eax
push dword [esi + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
mov dword [esi + 0x38], eax
je 0x11b2141
mov eax, dword [esi + 0x28]
push dword [ebx + eax + 0x102c]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x11b20b8
cmp eax, 3
jbe 0x11b20ab
cmp eax, 5
jbe 0x11b20b8
mov eax, dword [esi + 0x28]
mov byte [ebx + eax + 0x101c], 0
jmp 0x11b20cc
mov eax, dword [esi + 0x28]
mov byte [ebx + eax + 0x101c], 1
jmp 0x11b20cc
mov byte [ecx + 0x101c], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add ebx, 0x1034
xor ecx, ecx
cmp eax, dword [esi + 0x2c]
jl 0x11b1fc9
cmp dword [esi + 0x38], ecx
jne 0x11b20f0
or dword [esi + 0x38], 0xffffffff
xor eax, eax
jmp 0x11b2168
cmp dword [esi + 0x34], ecx
jne 0x11b2151
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ecx
push ecx
push 1
push ecx
call edi
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 0x3c], eax
je 0x11b2141
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x40], eax
je 0x11b2141
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x44], eax
je 0x11b2141
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x11b1f6f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x34], eax
jne 0x11b2148
mov eax, 0x80004003
jmp 0x11b2168
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop edi
pop ebx
pop esi
leave
ret 0x10
Function at 0x11b7c30
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
shr esi, 2
and edx, 3
test esi, esi
push edi
lea edi, [ecx + esi*4]
jle 0x11b7c68
cmp ecx, edi
jae 0x11b7c68
xor ebx, ebx
mov esi, dword [ecx]
add eax, esi
xor eax, ebx
add ecx, 4
xor eax, esi
add ebx, 4
cmp ecx, edi
jb 0x11b7c56
test edx, edx
jle 0x11b7c91
dec edx
mov edi, ecx
js 0x11b7c91
sub ecx, dword [ebp + 0xc]
lea esi, [edx + 1]
mov ebx, ecx
mov ecx, edx
shl ecx, 3
movzx edx, byte [edi]
shl edx, cl
sub ecx, 8
add eax, edx
xor eax, edx
xor eax, ebx
inc edi
inc ebx
dec esi
jne 0x11b7c7e
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x11b96ca
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp esi, edi
jne 0x11b96e5
mov eax, 0x80004003
jmp 0x11b975c
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, edi
je 0x11b975a
add eax, 3
and eax, 0xfffffffc
call fcn.01160330
cmp esp, edi
mov dword [ebp + 0xc], esp
je 0x11b975a
push esp
push ebx
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x11b975a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1007ab8
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x11b975a
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 8]
mov edx, edi
mov cl, 0x20
mov dword [esi], eax
mov dword [esi + 4], edi
call fcn.01160590
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebx + 0xc]
or dword [esi], eax
or dword [esi + 4], edi
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x11b998c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x128cb36
call fcn.01160168
sub esp, 0x28
push ebx
xor ebx, ebx
cmp dword [0x12d3588], ebx
mov dword [ebp - 0x24], ecx
je 0x11b99b1
mov eax, dword [0x12d3584]
jmp 0x11b9b27
push edi
xor edi, edi
inc edi
mov dword [0x12d3588], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov ecx, dword [0x12d28f8]
lea eax, [ebp - 0x18]
push eax
push 0x102d450
push 0x17
push ebx
push 0x10077bc
call fcn.0116b561
cmp eax, ebx
jge 0x11b99ff
mov dword [0x12d3584], ebx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x11b99f8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x11b9b26
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
mov ecx, dword [0x12d28f8]
mov eax, dword [ecx]
call dword [eax + 0x38]
push eax
lea ecx, [ebp - 0x10]
call fcn.0103966b
mov byte [ebp - 4], 2
push dword [0x12d07b4]
lea ecx, [ebp - 0x10]
call fcn.010524f5
push 0x20019
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push 0x80000002
call fcn.010449e2
test eax, eax
je 0x11b9a5e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010328fa
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.010449c4
jmp 0x11b99e7
push esi
push 8
pop esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [0x12d07ac]
mov dword [ebp - 0x34], ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x11b9afb
cmp dword [ebp - 0x20], 3
jne 0x11b9afb
cmp dword [ebp - 0x1c], esi
jne 0x11b9afb
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x2c]
push eax
push 0x10176ac
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.011b9929
cmp eax, ebx
jl 0x11b9afb
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jb 0x11b9ac9
ja 0x11b9ac3
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x34]
jbe 0x11b9ac9
mov dword [0x12d3584], edi
mov esi, dword [0x12d3584]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010328fa
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.010449c4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x11b9af7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x11b9b25
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010328fa
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.010449c4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x11b9b23
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop esi
pop edi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x11b9b39
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x128cb5d
call fcn.01160168
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x11b9b58
mov eax, 0x80004003
jmp 0x11b9c6d
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov ecx, dword [0x12d28f8]
mov eax, dword [ecx]
call dword [eax + 0x38]
push eax
lea ecx, [ebp - 0x14]
call fcn.0103966b
mov byte [ebp - 4], 1
push dword [0x12d07b4]
lea ecx, [ebp - 0x14]
call fcn.010524f5
push dword [0x12d07b8]
lea ecx, [ebp - 0x14]
call fcn.010524f5
push 0x20019
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 0x80000002
call fcn.010449e2
test eax, eax
jne 0x11b9c53
mov eax, dword [0x12ce0a0]
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
push 4
mov esi, 0x100
pop edi
jmp 0x11b9c1d
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
jne 0x11b9c37
call fcn.01032a0b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.010919b1
test eax, eax
je 0x11b9c40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010328fa
mov eax, dword [0x12ce0a0]
inc ebx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
call fcn.0103299e
test eax, eax
jne 0x11b9bc9
mov esi, 0x8007000e
jmp 0x11b9c45
call fcn.01032a0b
xor esi, esi
jmp 0x11b9c45
mov esi, 0x80004005
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010328fa
pop edi
pop ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.010328fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.010449c4
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x11b9cfb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.011b9b39
Function at 0x11b9dd9
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
call fcn.011b9d68
xor ebx, ebx
cmp eax, ebx
jl 0x11b9e76
cmp byte [ebp + 8], bl
jne 0x11b9e33
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [ebp - 4], 1
je 0x11b9e1a
test byte [ebp - 4], 2
jne 0x11b9e1a
push ebx
push 1
call dword [sym.imp.WININET.dll_InternetAutodial]
push ebx
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x11b9e56
push ebx
push 1
push ebx
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
je 0x11b9e56
xor eax, eax
cmp byte [ebp + 8], bl
push ebx
setne al
push ebx
push ebx
push eax
push 0x10176e0
call dword [sym.imp.WININET.dll_InternetOpenW]
push eax
mov ecx, esi
call fcn.011b9dad
cmp dword [esi], ebx
jne 0x11b9e74
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x11b9e66
call esi
jmp 0x11b9e76
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x11b9e76
xor eax, eax
pop esi
pop ebx
leave
ret 4
Function at 0x11c788b
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
cmp esi, edx
jne 0x11c78a1
mov eax, 0x80004003
jmp 0x11c78e9
mov dword [esi], edx
mov dword [esi + 4], edx
mov eax, dword [ecx + 0x368]
cmp dword [eax - 8], edx
push edi
je 0x11c78e6
push edx
push edx
push 3
push edx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x11c78d3
mov eax, 0x80004005
jmp 0x11c78e8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x11c78cc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x11cdbfd
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x128debf
call fcn.01160168
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x11cdc17
cmp dword [ebp + 0xc], ebx
jne 0x11cdc21
mov eax, 0x80004003
jmp 0x11cdd2b
push esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov ecx, dword [0x12d28f8]
mov eax, dword [ecx]
call dword [eax + 0x38]
push eax
lea ecx, [ebp - 0x14]
call fcn.0103966b
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.010524f5
push 0x20019
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 0x80000002
call fcn.010449e2
test eax, eax
je 0x11cdc6b
xor esi, esi
jmp 0x11cdd11
mov eax, dword [0x12ce0a0]
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
push 4
mov esi, 0x100
pop edi
jmp 0x11cdcdc
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
lea ecx, [ebp + 0xc]
push 0xffffffffffffffff
jne 0x11cdcf6
call fcn.01032a0b
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.010919b1
cmp eax, ebx
je 0x11cdcff
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.010328fa
mov eax, dword [0x12ce0a0]
inc dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
push esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
call fcn.0103299e
cmp eax, ebx
jne 0x11cdc85
mov esi, 0x8007000e
jmp 0x11cdd04
call fcn.01032a0b
xor esi, esi
jmp 0x11cdd04
mov esi, 0x80004005
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.010328fa
pop edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.010328fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.010449c4
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x11d63e6
Capabilities:
Create thread

Disassembly:
mov eax, 0x128e908
call fcn.01160168
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jne 0x11d64cb
cmp dword [edi + 8], ebx
je 0x11d64b3
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [edi + 0x1c], eax
je 0x11d64b3
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x10]
lea esi, [edi + 4]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x11d6453
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11d644e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
jmp 0x11d64cd
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11d64a2
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x14]
push eax
call fcn.011d20c6
mov esi, eax
cmp esi, ebx
jge 0x11d6488
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11d6484
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x11d64cd
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push 0x11d635e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [edi + 0x18], eax
jne 0x11d64ba
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11d64b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x11d64cd
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11d64cb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x11e1d7b
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101ca48
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x11e1e04
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101ca90
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x11e1e8d
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101cad8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x11e1f16
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101cb20
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x11e1f9f
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101cb68
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x11e2028
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101cbb0
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x11e20b1
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101cbf8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x11e213a
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101cc40
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x11e22d2
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128f70d
call fcn.01160168
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0118de42
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.0117e915
mov dword [esi], 0x101ccd0
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [ebp - 4], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc