joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100909a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov eax, dword [ecx + 0x1c]
mov edx, dword [ecx + 4]
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], edx
push 4
push 0x80
mov dword [edi + 4], 0x80
mov dword [edi + 8], 0x40
mov ecx, dword [eax + 0xb74]
mov dword [edi], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 0xa4], 0x80
mov eax, dword [eax + 4]
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0xb0], eax
call fcn.100a52d3
mov dword [edi + 0x24], eax
lea eax, [edi + 0x10]
push 0x80
push eax
call fcn.1008ff60
add esp, 0x10
xor esi, esi
nop dword [eax]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x101777a8]
mulsd xmm0, qword [0x101fcee8]
call fcn.100b1dc0
mov eax, dword [edi + 0x24]
cvtsd2ss xmm0, xmm0
movss dword [eax + esi*4], xmm0
mov eax, dword [edi + 0x24]
movss xmm0, dword [eax + esi*4]
mulss xmm0, xmm0
movss dword [eax + esi*4], xmm0
inc esi
cmp esi, 0x80
jl 0x10090a10
mov dword [edi + 0x28], 2
lea esi, [edi + 0x34]
mov dword [edi + 0x2c], 4
mov dword [edi + 0x38], 4
mov dword [edi + 0x3c], 5
mov dword [edi + 0x48], 6
mov dword [edi + 0x4c], 6
mov dword [edi + 0x58], 9
mov dword [edi + 0x5c], 8
mov dword [edi + 0x68], 0xd
mov dword [edi + 0x6c], 8
mov dword [edi + 0x78], 0x11
mov dword [edi + 0x7c], 8
mov dword [edi + 0x88], 0x16
mov dword [edi + 0x8c], 8
mov dword [esp + 0x24], 7
nop word [eax + eax]
mov ebp, dword [esi - 8]
lea eax, [ebp*4]
push eax
call fcn.100a843f
add esp, 4
mov edi, eax
xor ebx, ebx
mov dword [esi - 4], edi
test ebp, ebp
jle 0x10090b45
movd xmm1, ebp
cvtdq2pd xmm1, xmm1
movsd qword [esp + 0x14], xmm1
nop dword [eax]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [0x102511a0]
divsd xmm0, xmm1
mulsd xmm0, qword [0x101fcee8]
call fcn.100b1dc0
movsd xmm1, qword [esp + 0x14]
cvtsd2ss xmm0, xmm0
movss dword [edi + ebx*4], xmm0
mov edi, dword [esi - 4]
movss xmm0, dword [edi + ebx*4]
inc ebx
addss xmm0, dword [esi]
movss dword [esi], xmm0
cmp ebx, ebp
jl 0x10090b00
movss xmm0, dword [esi]
movsd xmm1, qword [0x101735a0]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esi], xmm0
add esi, 0x10
sub dword [esp + 0x24], 1
jne 0x10090ad0
mov ecx, dword [esp + 0x10]
push 0x90
lea eax, [ecx*8]
sub eax, ecx
push eax
call fcn.100a52d3
mov edi, dword [esp + 0x28]
push 4
push dword [edi + 0xa4]
mov dword [edi + 0x98], eax
call fcn.100a52d3
add esp, 0x10
mov dword [edi + 0xa0], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1016d3a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1016d3cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016d3cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4
Function at 0xe4fd10
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe4fd1a
pushal
call 0xe4fd20
pop ebp
sub ebp, 0x10
sub ebp, 0xa4fd10
jmp 0xe4fd36
mov eax, 0xa4fd10
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c6
mov edx, 0x3f6d7d13
xor byte [eax], dl
inc eax
dec ecx
jne 0xe4fd4d
jmp 0xe4fd60
cwde
ficomp word [eax + 0x13132f9a]
adc edx, dword [edx + 0x1313ebd2]
adc edx, dword [eax]
fisubr word [ebx + 0x13131316]
test eax, 0x1313133b
in al, 0xf1
adc bl, bl
cwde
xchg edx, eax
pop ds
adc edx, dword [ebx]
adc edx, dword [eax]
salc
inc ebx
sahf
ja 0xe4fdc1
out dx, eax
lcall 0x3289, 0xb37b3717
adc edi, dword [ebx + 0x63]
jno 0xe4fd27
nop
adc edx, dword [edx]
aas
aaa
jnp 0xe4fded
and ebp, dword [eax]
mov al, 0xfb
push ss
adc edx, dword [ebx]
adc edi, edx
and edx, dword [ebx]
adc edx, dword [ebx]
inc esi
sahf
jg 0xe4fde5
adc ebx, dword [eax + 0x13131b96]
adc ebx, dword [eax + 0x13131f86]
adc ebx, dword [eax + 0x1313039e]
adc edx, edx
cli
sar dl, cl
adc dword [edx], esp
adc dword [eax + 0x1c5a17d1], edx
xchg esi, eax
out 0xec, eax
in al, dx
in al, dx
cwde
aas
aaa
sahf
ja 0xe4fe0d
pop ss
rcr dword [edi], 1
adc ebx, dword [eax + 0x1317379f]
adc edx, dword [ebx]
jnp 0xe4fd96
mov dword [edx], esi
adc edi, dword [ebx + 0x63]
jno 0xe4fd7a
adc edx, dword [edx]
aas
aaa
inc edx
sti
push ss
adc edx, dword [ebx]
adc edi, edx
sub al, 0x11
adc edx, dword [ebx]
inc esi
inc edi
dec esi
in al, dx
pop ds
in al, dx
sbb di, bx
popal
adc edx, dword [ebx]
adc ebx, dword [eax + 0x13131bae]
adc esp, dword [eax]
ficom dword [edx - 0x6fbe861f]
and dl, bl
xchg edx, eax
loope 0xe4fe8b
inc ecx
nop
loopne 0xe4fda8
loope 0xe4fe91
inc ecx
nop
loopne 0xe4fe3c
rcl dword [eax + 0x1c5b16fb], 0x97
pop ebp
adc edx, dword [ebx]
adc ebx, dword [ebx + ebx*4]
pop ebx
adc edx, dword [ebx]
adc esi, dword [ebp - 0x68]
cvtpi2ps xmm2, qword [ebx - 0x68e30418]
or dword [ebx], edx
adc edx, dword [ebx]
xchg ebx, eax
call 0x37c1b3a
adc edx, dword [ebx]
adc esi, dword [ebp - 0x6e]
cli
sbb al, 0x97
add dl, byte [ebx]
adc edx, dword [ebx]
jne 0xe4fdd7
call 0x98013536
push es
adc edx, dword [ebx]
adc edx, dword [edx - 6]
fucompi st(4)
in al, dx
in al, dx
cmp bl, byte [edi + 0x2a]
adc dl, byte [eax - 0x46fe92e]
pop ss
cli
scasb al, byte es:[edi]
in al, dx
in al, dx
in al, dx
cmp al, byte [edi + 0x2a]
adc dword [eax - 0x66fea2e], edx
pop ss
nop
sti
push ss
cli
mov eax, 0x4eececec
rcr dword [edi], 1
adc eax, dword [esi - 0x68]
inc dword [ebp + 0x44]
inc esi
cwde
pop ds
cwde
outsb dx, byte [esi]
sbb ebp, edi
mov eax, dword [0x92159993]
aad 0x12
adc edx, dword [ebx]
adc ebx, dword [ebx + 0x12d49214]
adc al, 0x92
aam 0x12
adc edx, dword [ebx]
adc ebp, dword [eax + 0x13131311]
adc ecx, eax
sbb al, 0x96
push ss
adc edx, dword [ebx]
adc ebx, dword [ecx - 0x3efeaafb]
sbb al, 0x90
retf
Function at 0x401233
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov edx, dword fs:[0x18]
xor eax, eax
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0xc]
mov esi, edx
add esi, 0x14
mov edx, dword [edx + 0x14]
cmp edx, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
je 0x4013a3
jmp 0x40136c
mov eax, dword [ebp - 0x24]
mov ecx, eax
add ecx, 1
mov edx, dword [ebp - 0x28]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x32], si
mov word [ebp - 0x34], bx
jb 0x4012b7
mov ax, word [ebp - 0x32]
mov word [ebp - 0x34], ax
mov ax, word [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x38]
cmp esi, edi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x39], bl
mov dword [ebp - 0x24], esi
jne 0x401278
jmp 0x401391
mov al, byte [ebp - 0x3a]
test al, 1
jne 0x4012f8
jmp 0x401312
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x1c]
cmp edx, esi
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x20], eax
je 0x4013a3
jmp 0x401331
xor eax, eax
mov cx, word [ebp - 0x46]
shr cx, 1
movzx edx, cx
cmp cx, 0
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x24], eax
je 0x4012f8
jmp 0x401278
mov eax, dword [ebp - 0x44]
mov cx, word [eax + 0x24]
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x47]
and bh, bl
test bh, 1
mov dword [ebp - 0x40], eax
mov word [ebp - 0x46], cx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x4c], esi
jne 0x40135f
jmp 0x4012ef
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff8
mov dword [ebp - 0x20], eax
jmp 0x4013a3
mov eax, dword [ebp - 0x14]
cmp eax, 0
sete cl
mov edx, dword [ebp - 0x10]
cmp edx, 0
setne ch
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x3a], cl
mov byte [ebp - 0x47], ch
mov dword [ebp - 0x44], esi
jmp 0x401331
mov al, byte [ebp - 0x39]
test al, 1
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x20], ecx
jne 0x4013a3
jmp 0x4012f8
mov eax, dword [ebp - 0x20]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4015ea
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
mov word [ecx + 0xd4], 0x14c
mov word [ecx + 0xd6], 3
mov word [ecx + 0xe4], 0xe0
mov dword [ecx + 0xf8], 0x1030
mov word [ecx + 0xe8], 0x10b
mov edx, dword [eax + 0x44]
mov esi, esp
mov dword [esi + 0xc], 4
mov dword [esi + 8], 0x1000
mov dword [esi + 4], 0x14d000
mov dword [esi], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
call edx
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x10]
mov dword [esp + 4], ecx
mov dword [ebp - 0x14], eax
call fcn.0040144a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov esi, dword [ecx + 4]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov dword [ebp - 0x18], eax
call fcn.00401196
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x3c]
mov di, cx
cmp di, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x401727
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
sub edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [ebp - 0x24], eax
call fcn.00401c72
mov ecx, dword [ebp - 0x14]
mov dword [esp], ecx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [ebp - 0x28], eax
call fcn.00402430
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
mov dword [edx + 0x5c], esi
mov dword [edx + 0x40], 3
mov dword [edx + 0x14], 0x1030
mov dword [edx + 0x10], 0x14d000
mov edi, dword [ebp - 0x24]
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [ebp - 0x2c], eax
mov eax, ecx
add esp, 0x34
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x20]
add eax, 0xffff
and eax, 0xffff
add eax, 1
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x1c], ecx
jmp 0x4016b1
Function at 0x401f98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
lea ecx, [0xffde3000]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
call fcn.00401233
mov ecx, dword [eax + 0x3c]
mov si, cx
cmp si, 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
je 0x402099
jmp 0x40207f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x2c]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
jmp 0x402025
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x44]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x40], edi
jmp 0x401fff
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
je 0x402076
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x402025
mov al, byte [ebp - 0x4a]
test al, 1
jne 0x40200a
jmp 0x4020de
mov eax, dword [ebp - 0x1c]
add eax, 0xffff
and eax, 0xffff
add eax, 1
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 0x18]
add edx, dword [edx + eax + 0x20]
mov esi, dword [ebp - 0x18]
mov edi, dword [esi + eax + 0x18]
cmp edi, 0
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], ecx
je 0x401fff
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x44]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x401fe3
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x50]
cmp edx, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x40], eax
jb 0x401fe3
jmp 0x401fff
Function at 0x62242070
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [edi], 0
mov dword [esp + 4], 0x20
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
test eax, eax
je 0x622421d7
mov dword [eax], 1
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebx + 4], eax
test eax, eax
je 0x622421d0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [ebx + 8], eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x622421a0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
mov dword [ebx + 0xc], eax
sub esp, 0x18
test eax, eax
je 0x622421a0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [ebx + 0x10], eax
sub esp, 0x14
test eax, eax
je 0x622421a0
mov eax, ebx
call fcn.62241ec0
mov esi, eax
test eax, eax
js 0x622421b6
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.62241f60
mov esi, eax
test eax, eax
js 0x622421b6
mov dword [edi], ebx
xor esi, esi
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
mov dword [esp], ebx
call fcn.62242000
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x8007000e
jmp 0x622421b6
mov esi, 0x8007000e
jmp 0x622421be
Function at 0x62242770
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x54
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x622428a9
mov dword [eax], 0x6225a640
mov ebx, eax
mov dword [eax + 4], 0x6225a628
mov dword [eax + 8], 1
mov dword [eax + 0xc], 1
mov dword [eax + 0x4c], 0
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x50], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6225ec04
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x6225e9d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
js 0x62242894
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x28]
sub esp, 8
test eax, eax
js 0x62242886
mov eax, dword [ebp - 0x2c]
lea ecx, [ebx + 4]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x38]
sub esp, 8
test eax, eax
js 0x62242886
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], edi
mov edi, dword [eax]
mov dword [esp + 4], esi
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], esi
mov dword [esp], eax
call dword [edi + 0x4c]
sub esp, 0x14
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x8007000e
jmp 0x622428a1
Function at 0x622446a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
cmp eax, ebx
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], eax
je 0x6224471a
mov edi, dword fs:[0x18]
lea esi, [esi]
nop
mov eax, dword [ebx + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
sub esp, 0xc
mov dword [ecx + 4], eax
mov ecx, dword [ebx]
mov dword [eax], ecx
mov dword [esp + 8], ebx
mov ebx, esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov esi, dword [esi]
sub esp, 0xc
cmp dword [ebp + 8], ebx
jne 0x622446c8
mov edx, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov edx, dword [edx + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x62246ab0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x62246b34
mov dword [eax], str._h_b
mov ebx, eax
lea eax, [eax + 0x18]
mov dword [eax - 0x14], 0x6225afa0
mov dword [eax - 0x10], 1
mov dword [eax - 8], 0
mov dword [eax - 4], 0
mov dword [eax - 0xc], esi
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x18], eax
test esi, esi
je 0x62246b26
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 4]
sub esp, 4
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, 0x8007000e
jmp 0x62246b2d
Function at 0x622472b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ecx, dword fs:[0x18]
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], edx
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0xc], esi
mov ebx, eax
sub esp, 0xc
movzx eax, word [edx + 4]
mov dword [ebp - 0x20], edx
mov dword [esp + 4], 0
imul eax, eax, 0x1a
mov dword [esp + 8], eax
mov eax, dword [0x6226d010]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x20]
mov dword [ebx + 8], 0
mov dword [ebp - 0x1c], eax
sub esp, 0xc
mov dword [ebx + 0x10], eax
movzx eax, word [edx + 6]
add esi, dword [edx]
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], esi
test al, 1
jne 0x62247390
test byte [0x62258078], 2
jne 0x62247480
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x6226d010]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, word [edx + 4]
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], 0
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [ebx + 0x1c], eax
movzx ecx, word [edx + 4]
mov dword [esp + 4], esi
mov dword [esp], eax
mov edi, ecx
shl ecx, 2
mov dword [esp + 8], ecx
call sub.ucrtbase.dll_memcpy
test di, di
je 0x6224743c
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov edi, 0xffffec83
mov dword [esi], eax
add ecx, 1
add eax, 0x1a
mov word [eax - 0x19], di
mov edi, 0x4c7
mov word [eax - 0x16], di
mov edi, 0xffffd0ff
mov word [eax - 0xa], di
mov edi, 0x25ff
mov word [eax - 6], di
movzx edi, word [edx + 4]
mov dword [eax - 4], esi
add esi, 4
mov byte [eax - 0x1a], 0x51
mov byte [eax - 0x17], 4
mov byte [eax - 0x14], 0x24
mov byte [eax - 0xf], 0xb8
mov byte [eax - 8], 0x58
mov byte [eax - 7], 0x59
mov dword [eax - 0x13], ebx
mov dword [eax - 0xe], 0x62248640
cmp edi, ecx
jg 0x622473e0
mov dword [esp], 0x62258060
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6226d00c]
mov dword [ebx], 0x6226d008
sub esp, 4
mov dword [ebx + 4], eax
mov dword [eax], ebx
mov dword [0x6226d00c], ebx
mov dword [esp], 0x62258060
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unsupported_vtable_fixup_flags__x_n
mov dword [esp + 8], str.FixupVTableEntry
mov dword [esp + 4], 0x62258078
mov dword [esp], 1
call fcn.62246f10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x1c], eax
jmp 0x62247344