joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4187e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x418805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x418878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x41883a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x41886d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x41886b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x418831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4187fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4013e0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [eax + 4]
push ebp
mov ebp, dword [eax]
push esi
push edi
mov dword [esp + 0x10], 0x58d84e99
mov esi, 0
mov edx, 0
add eax, eax
mov eax, dword [esp + 0x10]
mov ecx, 0xc6ef3720
sub edx, eax
sub edi, 5
mov eax, 0
mov edi, dword [esp + 0x18]
mov eax, ebp
shr eax, 5
mov edx, ebp
shl edx, 4
xor eax, edx
mov edx, ecx
shr edx, 0xb
and edx, 3
add eax, dword [edi + edx*4]
mov edx, ecx
xor edx, ebp
add eax, edx
sub ebx, eax
mov eax, 0
add ecx, 0x61c88647
sub edx, eax
sub eax, eax
sub esi, eax
mov eax, ebx
shr eax, 5
mov edx, ebx
shl edx, 4
xor eax, edx
mov edx, ecx
and edx, 3
add eax, dword [edi + edx*4]
mov edx, ecx
xor edx, ebx
add eax, edx
sub ebp, eax
test ecx, ecx
jne 0x401415
mov edx, 0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
mov dword [eax + 4], ebx
pop ebx
pop ecx
ret
Function at 0x41b2e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x41b302
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41b309
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41b2f8
mov eax, 1
add ebx, ebx
jne 0x41b31b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41b310
jne 0x41b32c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b310
xor ecx, ecx
sub eax, 3
jb 0x41b340
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41b3b2
mov ebp, eax
add ebx, ebx
jne 0x41b34b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41b358
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41b37c
inc ecx
add ebx, ebx
jne 0x41b368
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41b35d
jne 0x41b379
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b35d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41b39c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41b38d
jmp 0x41b2fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41b39c
add edi, ecx
jmp 0x41b2fe
pop esi
mov edi, esi
mov ecx, 0x6b8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41b3ba
cmp byte [edi], 6
jne 0x41b3ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41b3bf
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41b42e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b484]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b55c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41b3ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b564]
or eax, eax
je 0x41b428
mov dword [ebx], eax
add ebx, 4
jmp 0x41b409
call dword [esi + 0x1b560]
mov ebp, dword [esi + 0x1b568]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41b462
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4e878d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e8603
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1000122e
push 0
push 0
push 0
push 0x10001040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x63a31b87
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x59dc7cc8
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x10001339
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x10001374
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10001370
lea ebx, [ebx]
cmp esi, edx
jae 0x10001374
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10001360
cmp esi, edx
jb 0x1000137b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45fdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e9b34
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
call fcn.0045ff50
lea ecx, [edi + 0x30]
mov dword [esp + 0x18], 0
call fcn.0045ff50
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 1
call fcn.0045ff50
lea ecx, [edi + 0x90]
mov byte [esp + 0x18], 2
call fcn.0045ff50
lea ecx, [edi + 0xc0]
mov byte [esp + 0x18], 3
call fcn.0045ff50
lea ecx, [edi + 0xf0]
mov byte [esp + 0x18], 4
call fcn.0045ff50
lea ecx, [edi + 0x120]
mov byte [esp + 0x18], 5
call fcn.0045ff50
lea ecx, [edi + 0x150]
mov byte [esp + 0x18], 6
call fcn.0045ff50
lea ecx, [edi + 0x180]
mov byte [esp + 0x18], 7
call fcn.0045ff50
lea ecx, [edi + 0x1b0]
mov byte [esp + 0x18], 8
call fcn.0045ff50
lea ecx, [edi + 0x1e0]
mov byte [esp + 0x18], 9
call fcn.0045ff50
lea ecx, [edi + 0x210]
mov byte [esp + 0x18], 0xa
call fcn.0045ff50
mov dword [edi + 0x240], 0
mov dword [edi + 0x244], 0
mov dword [edi + 0x248], 0
mov dword [edi + 0x24c], 0
mov dword [edi + 0x250], 0
mov dword [edi + 0x254], 0
lea ecx, [edi + 0x258]
mov byte [esp + 0x18], 0xd
mov dword [edi + 0x258], 0
mov dword [edi + 0x25c], 0
call fcn.00464130
mov dword [edi + 0x258], eax
lea ecx, [edi + 0x260]
mov byte [esp + 0x18], 0xe
mov word [ecx + 0x18], 0
call fcn.0046d1c0
lea ecx, [edi + 0x27c]
mov byte [esp + 0x18], 0xf
call fcn.0049f570
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x460010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e9c08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x44f1f4
xor eax, eax
mov dword [edi + 4], 0
mov word [edi + 8], ax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], eax
mov byte [edi + 0x18], al
mov dword [edi + 0x14], 0x44fa2c
mov dword [edi + 0x48], 0xf
mov dword [edi + 0x44], eax
mov byte [edi + 0x34], al
mov dword [edi + 0x30], 0x44fa2c
mov dword [edi + 0x64], 0xf
mov dword [edi + 0x60], eax
mov byte [edi + 0x50], al
mov dword [edi + 0x4c], 0x44fa2c
mov byte [edi + 0x68], al
mov dword [edi + 0x6c], eax
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
mov byte [edi + 0x8c], 1
mov dword [edi + 0x90], 1
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], eax
mov dword [edi + 0x9c], eax
mov dword [edi + 0x7c], 0x44f1f0
mov dword [esp + 0x18], eax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], eax
lea eax, [edi + 0x18c]
mov byte [esp + 0x18], 1
push 0
push eax
mov byte [eax + 0x128], 0
call fcn.004ca830
add esp, 8
mov dword [edi + 0x2b8], 0
mov dword [edi + 0x2c4], 0
mov dword [edi + 0x2c8], 0
mov dword [edi + 0x2cc], 0
lea ecx, [edi + 0x2d0]
mov byte [esp + 0x18], 3
mov dword [edi + 0x2d0], 0
mov dword [edi + 0x2d4], 0
call fcn.00464220
mov dword [edi + 0x2d0], eax
mov dword [edi + 0x2d8], 0
mov dword [edi + 0x2dc], 0
mov dword [edi + 0x2e0], 0
mov dword [edi + 0x2ec], 0
mov dword [edi + 0x2f0], 0
mov dword [edi + 0x2f4], 0
mov eax, dword [0x504c30]
test al, 1
jne 0x4601b2
or eax, 1
mov dword [0x504c30], eax
push 0x504ae0
mov byte [esp + 0x1c], 7
call fcn.004cb030
push 0x4f1ee0
call fcn.004d118d
add esp, 8
mov dword [edi + 0x2f8], 0x504ae0
mov dword [edi + 0x310], 0
mov dword [edi + 0x314], 0
mov dword [edi + 0x318], 0
mov byte [edi + 0x31c], 1
mov dword [edi + 0x320], 1
mov dword [edi + 0x324], 0
mov dword [edi + 0x328], 0
mov dword [edi + 0x32c], 0
mov dword [edi + 0x30c], 0x44f1f0
mov ecx, edi
mov byte [esp + 0x18], 8
call fcn.00462a50
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x460710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e9dca
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0
call fcn.004d07b9
mov dword [esp + 0x20], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [esp + 0x28]
mov byte [esp + 0x20], 6
test eax, eax
jne 0x4607b9
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x44f154
push eax
lea ecx, [esp + 0x10]
call fcn.004d250d
push 0x4f3064
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x44fa80
push eax
call fcn.004d1803
push eax
push esi
call fcn.004d0d30
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 4

Function at 0x4607e0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4e9df8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x502c60]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0045c010
push dword [esp + 0x54]
lea eax, [esp + 0x28]
push dword [esp + 0x54]
push eax
call fcn.00465410
add esp, 0x24
cmp dword [eax + 0x14], 0x10
mov dword [esp + 0x30], 0
jb 0x46085a
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.004d250d
cmp dword [esp + 0x20], 0x10
mov dword [esi], 0x44fa80
jb 0x460883
push dword [esp + 0xc]
call fcn.004d105d
add esp, 4
mov ecx, dword [esp + 0x38]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi], 0x44facc
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004d17f4
add esp, 0x2c
ret 0xc
Function at 0x46eed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4eb2bc
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x44f43c
lea ecx, [edi + 4]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.004758a0
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [esp + 0x18], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.004758a0
mov dword [edi + 0xc], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
lea ecx, [edi + 0x24]
mov byte [esp + 0x18], 2
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.00475870
mov dword [edi + 0x24], eax
lea ecx, [edi + 0x2c]
mov byte [esp + 0x18], 3
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00475870
mov dword [edi + 0x2c], eax
mov eax, edi
mov dword [edi + 0x14], 0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x471d30
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x4eb5b0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x502c60]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
push edi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov edi, ecx
push dword [0x4fe028]
push dword [0x4fe024]
call fcn.004a2770
cmp dword [0x4fe014], 0
je 0x471db0
push 0x10
push 0xc
mov ecx, edi
call fcn.004a26c0
mov edx, dword [0x4fe014]
mov esi, eax
mov ecx, dword [edx]
mov dword [esi + 4], ecx
movzx ecx, word [edx + 4]
mov word [esi + 8], cx
movzx ecx, word [edx + 6]
mov word [esi + 0xa], cx
mov eax, dword [edx + 8]
mov dword [esi + 0xc], eax
mov eax, dword [edx + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [0x4fe010]
test eax, eax
je 0x471e3d
mov edx, 0x44f171
mov dword [esp + 0x34], 0xf
cmovne edx, eax
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
cmp byte [edx], 0
jne 0x471de3
xor eax, eax
jmp 0x471df1
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x471de8
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.0045c120
mov dword [esp + 0x1c], 0x44fa2c
lea eax, [esp + 0x1c]
mov dword [esp + 0x64], 0
push eax
push 8
mov ecx, edi
call fcn.004a2670
cmp dword [esp + 0x34], 0x10
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x1c], 0x44fa2c
jb 0x471e3d
push dword [esp + 0x20]
call fcn.004d105d
add esp, 4
push 8
push 9
mov ecx, edi
call fcn.004a26c0
movzx ecx, word [0x4fe018]
mov edx, eax
push 8
push 0x102
mov word [edx + 4], cx
movzx ecx, word [0x4fe01a]
mov word [edx + 6], cx
mov ecx, edi
movzx eax, word [0x4fe01c]
mov word [edx + 8], ax
movzx eax, word [0x4fe01e]
mov word [edx + 0xa], ax
call fcn.004a26c0
push 4
add eax, 4
mov ecx, edi
push 0x108
mov dword [edi + 0x18], eax
call fcn.004a26c0
push 4
add eax, 4
mov ecx, edi
push 0xa
mov dword [edi + 0x1c], eax
call fcn.004a26c0
mov esi, eax
lea eax, [esp + 0x38]
push eax
call fcn.004a1ad0
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x64], 1
push ecx
mov ecx, eax
call fcn.004a1280
lea ecx, [esp + 0x38]
mov dword [esp + 0x64], 0xffffffff
call fcn.004a40d0
mov ecx, dword [esp + 0x14]
movzx eax, word [esp + 0x18]
shl ecx, 6
or ecx, dword [esp + 0x16]
shr ax, 1
shl ecx, 5
or cx, ax
mov eax, dword [esp + 0xc]
add eax, 0xffffffc4
movzx ecx, cx
shl eax, 4
or eax, dword [esp + 0xe]
shl eax, 5
or eax, dword [esp + 0x12]
mov word [esi + 4], ax
mov word [esi + 6], cx
test byte [0x4fe00c], 4
je 0x471f33
push 4
push 0x104
mov ecx, edi
call fcn.004a26c0
add eax, 4
mov dword [edi + 0x20], eax
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004d17f4
add esp, 0x5c
ret
Function at 0x476930
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4eba23
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0
mov dword [edi], 0x44f620
lea ecx, [edi + 8]
push 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.0046c660
mov dword [edi + 8], eax
push 0
push 0
lea ecx, [edi + 0x10]
mov dword [esp + 0x20], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0046c660
mov dword [edi + 0x10], eax
push 0
push 0
lea ecx, [edi + 0x18]
mov byte [esp + 0x20], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.0046c660
mov dword [edi + 0x18], eax
push 0
push 0
lea ecx, [edi + 0x20]
mov byte [esp + 0x20], 2
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.0046c660
mov dword [edi + 0x20], eax
push 0
push 0
lea ecx, [edi + 0x28]
mov byte [esp + 0x20], 3
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0046c620
mov dword [edi + 0x28], eax
push 0
push 0
lea ecx, [edi + 0x30]
mov byte [esp + 0x20], 4
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.0046c620
mov dword [edi + 0x30], eax
lea ecx, [edi + 0x38]
mov byte [esp + 0x18], 5
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
call fcn.00477100
mov dword [edi + 0x38], eax
lea ecx, [edi + 0x40]
mov byte [esp + 0x18], 6
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
call fcn.00477100
mov dword [edi + 0x40], eax
lea ecx, [edi + 0x48]
mov byte [esp + 0x18], 7
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
call fcn.00464190
mov dword [edi + 0x48], eax
mov ecx, edi
mov byte [esp + 0x18], 8
call fcn.0046c0a0
mov byte [edi + 4], al
mov ecx, edi
mov byte [edi + 5], 0
call fcn.0046c1c0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x476ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4eba56
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x502c60]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x20]
lea ecx, [edi + 0x10]
mov dword [edi], 0x44f618
mov dword [edi + 8], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00477130
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x30]
mov dword [esp + 0x18], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edi + 0xc], 0
mov byte [edi + 4], 0
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
mov byte [esp + 0x18], 1
cmp eax, 0x400
jae 0x476b54
push 0x400
call fcn.00477160
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4