joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45f4c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 8], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x14], 0
movdqu xmmword [ebp - 0x18], xmm0
jne 0x42e477
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f51f
mov esp, ebp
pop ebp
ret 8
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push edi
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42e4d8
call edi
cmp eax, 0x3e5
je 0x42e4d8
test eax, eax
je 0x42e4d8
push eax
push str.Error_0x_X_in_WriteFile
push 0x451150
push 0x46064c
call fcn.00417ac0
add esp, 0x10
mov dword [ebp - 8], 0
jmp 0x42e55f
push 0xbb8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42e50c
push str.Timeout_waiting_to_send_message
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0xc
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x42e55f
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x42e548
call edi
push eax
push str.Failed_to_send_message__Error_0x_X_
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0x10
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x42e55f
push str.Message_sent.
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0xc
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 8]
test eax, eax
jne 0x42e5b8
push str.Zero_bytes_written._Disconnecting_driver_ifc.
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0xc
push str.Disconnecting_driver_interface.
push 0x450cfc
push 0x46064c
call fcn.00417ac0
mov eax, dword [esi + 0x18]
add esp, 0xc
cmp eax, 0xffffffff
je 0x42e5b1
push eax
call edi
mov dword [esi + 0x18], 0xffffffff
mov eax, dword [ebp - 8]
mov byte [esi + 0x14], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042f51f
mov esp, ebp
pop ebp
ret 8
Function at 0x42e5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45f4c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 8], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x14], 0
movdqu xmmword [ebp - 0x18], xmm0
jne 0x42e617
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f51f
mov esp, ebp
pop ebp
ret 8
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push edi
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42e678
call edi
cmp eax, 0x3e5
je 0x42e678
test eax, eax
je 0x42e678
push eax
push str.Error_0x_X_in_ReadFile
push 0x451150
push 0x46064c
call fcn.00417ac0
add esp, 0x10
mov dword [ebp - 8], 0
jmp 0x42e6ff
push 0xbb8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42e6ac
push str.Timeout_waiting_for_a_message
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0xc
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x42e6ff
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x42e6e8
call edi
push eax
push str.Failed_to_recieve_message__Error_0x_X_
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0x10
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x42e6ff
push str.Message_received
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0xc
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 8]
test eax, eax
jne 0x42e758
push str.Zero_bytes_read._Disconnecting_driver_interface.
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0xc
push str.Disconnecting_driver_interface.
push 0x450cfc
push 0x46064c
call fcn.00417ac0
mov eax, dword [esi + 0x18]
add esp, 0xc
cmp eax, 0xffffffff
je 0x42e751
push eax
call edi
mov dword [esi + 0x18], 0xffffffff
mov eax, dword [ebp - 8]
mov byte [esi + 0x14], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042f51f
mov esp, ebp
pop ebp
ret 8
Function at 0x44153a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45f4c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00433f8b
mov dword [ebp - 0x14], eax
cmp dword [0x4620e8], esi
jne 0x44162d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4415ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x44170d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x44170d
push 0x4508a4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44170d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4620e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4620ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4620f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4620f8], eax
test eax, eax
je 0x44162a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4620f4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x441652
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x441645
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x441667
push 4
pop eax
jmp 0x44170f
cmp dword [ebp - 0x14], esi
je 0x441667
push dword [0x4620e8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x44164c
mov eax, dword [0x4620f4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4416c5
cmp dword [0x4620f8], edi
je 0x4416c5
push eax
call ebx
push dword [0x4620f8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4416c5
test eax, eax
je 0x4416c5
call ecx
test eax, eax
je 0x4416ba
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4416ba
test byte [ebp - 8], 1
jne 0x4416c5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4416f5
mov eax, dword [0x4620ec]
cmp eax, edi
je 0x4416f2
push eax
call ebx
test eax, eax
je 0x4416f2
call eax
mov esi, eax
test esi, esi
je 0x4416f2
mov eax, dword [0x4620f0]
cmp eax, edi
je 0x4416f2
push eax
call ebx
test eax, eax
je 0x4416f2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4620e8]
call ebx
test eax, eax
je 0x44170d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x44170f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f51f
mov esp, ebp
pop ebp
ret
Function at 0x409870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6453a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x6ee988]
call fcn.00491110
add esp, 4
mov dword [0x6ee988], eax
test eax, eax
jne 0x409948
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x34], eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x65006b
lea edx, [eax + 2]
mov dword [ebp - 0x28], 0x6e0072
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x320033
mov dword [ebp - 0x1c], 0x64002e
mov dword [ebp - 0x18], 0x6c006c
mov dword [ebp - 0x30], 7
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409900
sub eax, edx
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040cbc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
push eax
call fcn.0048d690
add esp, 4
mov dword [0x6ee988], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00407b80
mov eax, dword [0x6ee988]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x40c2e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40c381
cmp byte [esi + 0x3d], 0
je 0x40c381
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40c337
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40c349
sub eax, 1
je 0x40c34d
sub eax, 2
je 0x40c381
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40c36a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0060bd39
add esp, 0x10
cmp edi, eax
jne 0x40c337
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x40dba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40dbd0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40dc0c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40dc0c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40dcf1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40dc34
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40dc67
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0060b3d5
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40dcf1
cmp eax, 1
jle 0x40dcc4
cmp eax, 3
jne 0x40dcf1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00405370
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40dce1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0060bd39
add esp, 0x10
cmp edi, eax
jne 0x40dcf1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40dbf7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4
Function at 0x40ee50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40ee74
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ef40
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x40ee95
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40ee97
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40ef1f
jg 0x40eeaa
test esi, esi
je 0x40ef1f
test ecx, ecx
jl 0x40eeec
jg 0x40eeb4
test eax, eax
je 0x40eeec
cmp ebx, ecx
jg 0x40eec6
jl 0x40eebe
cmp esi, eax
jae 0x40eec6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.006072a0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40eef2
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40ef1f
jg 0x40eefc
test esi, esi
je 0x40ef1f
cmp dword [edi + 0x4c], 0
je 0x40ef1f
mov ecx, edi
call fcn.0040c790
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0060b6a5
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40f034
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f0f0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x40f055
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40f057
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x40f0d4
jg 0x40f06a
test esi, esi
je 0x40f0d4
test ecx, ecx
jl 0x40f0ae
jg 0x40f074
test eax, eax
je 0x40f0ae
cmp edi, ecx
jg 0x40f086
jl 0x40f07e
cmp esi, eax
jae 0x40f086
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.006072a0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40f0b1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40f0d4
jg 0x40f0bb
test esi, esi
je 0x40f0d4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40f0d4
push eax
push esi
push 1
push edx
call fcn.0060bd39
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4117f0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646af5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x19
lea ecx, [esi + 0x274]
call fcn.004110d0
mov byte [ebp - 4], 0x18
lea ecx, [esi + 0x258]
call fcn.00407b80
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0x240]
call fcn.00407b80
mov byte [ebp - 4], 0x16
lea ecx, [esi + 0x228]
call fcn.00407b80
mov byte [ebp - 4], 0x15
lea ecx, [esi + 0x210]
call fcn.00407b80
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0x1f8]
call fcn.00407b80
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1e0]
call fcn.00407b80
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x1c8]
call fcn.00407b80
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x1b0]
call fcn.00407b80
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x198]
call fcn.00407b80
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x180]
call fcn.00407b80
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x168]
call fcn.00407b80
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x150]
call fcn.00407b80
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x138]
call fcn.00407b80
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x120]
call fcn.00407b80
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x108]
call fcn.00407b80
mov byte [ebp - 4], 9
lea ecx, [esi + 0xf0]
call fcn.00407b80
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.00407b80
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.00407b80
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.00407b80
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.00407b80
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.00407b80
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.00407b80
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00407b80
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00407b80
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00407b80
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00407b80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428640
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64a8de
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 1
xor ecx, ecx
mov byte [edi + 0x18], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 7
mov word [edi + 0x1c], cx
mov byte [ebp - 4], 2
mov eax, dword [edi + 4]
mov esi, dword [edi]
cmp esi, eax
je 0x4286ed
mov edi, eax
mov ecx, esi
call fcn.0042d090
add esi, 0x138
cmp esi, edi
jne 0x4286d7
mov edi, dword [ebp - 0x34]
mov esi, dword [edi]
mov dword [edi + 4], esi
mov eax, dword [edi + 0x10]
mov esi, dword [edi + 0xc]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x428717
mov edi, eax
nop
mov ecx, esi
call fcn.0042d090
add esi, 0x138
cmp esi, edi
jne 0x428700
mov edi, dword [ebp - 0x34]
mov esi, dword [edi + 0xc]
push 0x60
mov dword [edi + 0x10], esi
call fcn.005e9c63
mov esi, eax
add esp, 4
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x42874b
push 0x60
push 0
push esi
call fcn.00607da0
add esp, 0xc
mov ecx, esi
call fcn.00428970
mov byte [ebp - 4], 3
jmp 0x42874d
xor esi, esi
mov byte [ebp - 4], 2
mov dword [edi + 0x34], esi
mov byte [ebp - 4], 5
xor eax, eax
push eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push 0x67ed6c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040cbc0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], 1
lea esi, [edi + 0x1c]
cmp esi, eax
je 0x4287c5
mov ecx, esi
call fcn.00421720
movups xmm0, xmmword [ebp - 0x28]
xor eax, eax
mov word [ebp - 0x28], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov ecx, 1
mov dword [ebp - 0x30], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00407b80
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x429880
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64ad9f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
push 0x67ed6c
mov word [esi], ax
call fcn.0040cbc0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push 4
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x6801c8
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 1
xor eax, eax
lea ecx, [esi + 0x30]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
push 2
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x6801d4
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
push 2
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x6801d4
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
push 4
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x6801dc
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 5
xor eax, eax
lea ecx, [esi + 0x90]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
push 1
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x6801e8
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
mov dword [ecx + 0x10], 0
xor eax, eax
mov dword [ecx + 0x14], 7
push eax
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 8
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0
mov dword [esi + 0xe0], 0
mov byte [ebp - 4], 9
xor eax, eax
lea ecx, [esi + 0xe4]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 0xa
xor eax, eax
lea ecx, [esi + 0xfc]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 0xb
xor eax, eax
lea ecx, [esi + 0x114]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 0xc
xor eax, eax
lea ecx, [esi + 0x12c]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret