joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f6095
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x5f61d9
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x5f61b3
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x5f60fe
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x5f60d5
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x5f61e1
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x5f6317
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x5f62f2
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x5f6240
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x5f621c
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret

Function at 0x5fdabc
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x5fdae9
push esi
call fcn.00603cc9
cmp byte [esi + 0x40], 0
pop ecx
je 0x5fdae2
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x5fdb58
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x5fdb4d
mov eax, dword [esi + 8]
test eax, eax
je 0x5fdb0a
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x5fdb49
cmp eax, 2
je 0x5fdb4d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5fdaff
cmp eax, 3
je 0x5fdb2e
cmp eax, 1
jne 0x5fdaff
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x5fdaff
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5fdaff
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x5fdb76
cmp eax, 0xcc
je 0x5fdb76
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.005fd994
pop esi
ret
Function at 0x414830
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7078
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4ec008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00420b90
mov edi, dword [sym.imp.USER32.dll_LoadIconW]
push 1
push 0x64
push 0x400000
call edi
mov esi, dword [sym.imp.2345MiniUI.dll_public:_struct_HICON______thiscall_RCMiniAtlWindow::SetIcon_struct_HICON_____int_]
lea ecx, [ebx - 0x1c]
push eax
call esi
push 0
push 0x65
push 0x400000
call edi
push eax
lea ecx, [ebx - 0x1c]
call esi
mov ecx, dword [ebx + 0xc0]
mov esi, dword [ebx - 0x1c]
test ecx, ecx
je 0x414900
cmp dword [ebx + 0xd8], 8
lea eax, [ebx + 0xc4]
jb 0x4148ab
mov eax, dword [eax]
sub esp, 0xc
push eax
push ecx
call fcn.004812e0
test al, al
je 0x414900
mov ecx, dword [ebx + 0xc0]
push 0
sub esp, 0xc
call fcn.00481350
mov ecx, dword [ebx + 0xc0]
test al, al
jne 0x4148da
call fcn.004813c0
jmp 0x414900
mov eax, dword [ecx + 4]
test eax, eax
jne 0x4148f3
call fcn.004813a0
mov ecx, dword [ebx + 0xc0]
call fcn.004813c0
jmp 0x414900
mov dword [eax], esi
mov ecx, dword [ebx + 0xc0]
call fcn.004813a0
xor eax, eax
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
push 0x4c3b5c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call fcn.004126a0
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x84]
mov eax, dword [ebx - 0x1c]
mov dword [ebx + 0xbc], eax
lea eax, [ebp - 0x24]
cmp ecx, eax
je 0x41495e
cmp dword [ebp - 0x10], 8
push dword [ebp - 0x14]
cmovae eax, dword [ebp - 0x24]
push eax
call fcn.004126a0
push ecx
lea ecx, [ebx + 0x78]
call fcn.0041ddb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00412640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4180f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7910
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4ec008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
test eax, eax
je 0x418239
cmp byte [eax + 0x54], 0
je 0x418239
add eax, 0x1c
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call fcn.00416be0
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x41815a
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41820d
push 0
mov edx, edi
lea ecx, [ebp - 0x34]
call fcn.0047ff30
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x38]
push 0
push ecx
push dword [ebp - 0x24]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x4181fb
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4181f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4181f1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004a5002
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x418232
cmp byte [ebp - 0x18], 0
je 0x418232
mov eax, dword [esi]
test eax, eax
je 0x41822e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a4c33
mov esp, ebp
pop ebp
ret 4
Function at 0x41ede0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8910
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4ec008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x34]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
xor esi, esi
mov dword [ebp - 0x18], esi
xor bl, bl
push fcn.00414b00
mov byte [ebp - 0x14], bl
push 6
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41eec9
cmp dword [ebp - 0x34], esi
je 0x41eec9
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x30]
push str.9CDB4DA2_ACEA_446E_AA3A_D25628140939__d__p
push eax
call fcn.004785e0
add esp, 0x10
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41eeba
push 0xffffffffffffffff
push esi
call edi
test eax, eax
jne 0x41eea9
mov bl, 1
mov byte [ebp - 0x14], bl
jmp 0x41eeba
xor bl, bl
push esi
mov byte [ebp - 0x14], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00412640
mov dword [ebp - 4], 1
cmp byte [0x4f9150], 0
jne 0x41ef02
mov ecx, dword [0x4f9130]
test ecx, ecx
je 0x41eeee
push 0xffffffffffffffff
push ecx
call edi
mov ecx, dword [0x4f9130]
mov eax, dword [0x4f9128]
mov edi, dword [eax]
test ecx, ecx
je 0x41ef04
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x41ef04
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x41ef1c
test esi, esi
je 0x41ef2f
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x41ef20
test esi, esi
je 0x41ef2f
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov dword [ebp - 0x18], 0
mov eax, edi
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c33
mov esp, ebp
pop ebp
ret
Function at 0x42f360
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab0b7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4ec008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov byte [edi], 0
call fcn.004a4c57
add esp, 4
mov dword [edi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
lea esi, [edi + 8]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430c20
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430c20
mov dword [esi], eax
mov byte [ebp - 4], 6
xor eax, eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov byte [ebp - 4], 7
lea ecx, [edi + 0x38]
call fcn.0041bcb0
mov byte [ebp - 4], 8
lea eax, [edi + 0xb8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [edi + 0x100], ecx
mov dword [edi + 0x104], 7
mov word [edi + 0xf0], ax
mov byte [ebp - 4], 0xb
mov dword [edi + 0x118], eax
mov dword [edi + 0x11c], 0xf
mov byte [edi + 0x108], al
mov byte [ebp - 4], 0xc
mov dword [edi + 0x130], eax
mov dword [edi + 0x134], 0xf
mov byte [edi + 0x120], al
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab6de
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4ec008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x50], edi
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x54], edi
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 7
mov dword [ebp - 0x4c], eax
mov word [edi + 0x84], cx
mov dword [ebp - 4], ecx
lea eax, [edi + 0x24]
push 0x60
push ecx
push eax
mov byte [edi + 0x9c], 1
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x48]
push esi
call fcn.00412560
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], 0
jne 0x4313d0
lea ecx, [ebp - 0x48]
call fcn.0048e4b0
cmp dword [ebp - 0x38], 0
je 0x4314aa
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x10], 0
je 0x4314aa
push eax
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.0047a4a0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x48]
cmp eax, esi
je 0x431424
mov ecx, eax
call fcn.00412640
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00412640
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x43002e
mov dword [ebp - 0x2c], 0x650068
lea edx, [eax + 2]
mov dword [ebp - 0x28], 0x6b0063
mov dword [ebp - 0x24], 0x740053
mov dword [ebp - 0x20], 0x740061
mov dword [ebp - 0x1c], 0x64002e
mov dword [ebp - 0x18], 0x740061
mov dword [ebp - 0x14], 0x61
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431470
sub eax, edx
lea ecx, [ebp - 0x48]
sar eax, 1
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00418570
lea eax, [ebp - 0x48]
lea ecx, [edi + 0x84]
cmp ecx, eax
je 0x4314aa
cmp dword [ebp - 0x34], 8
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.004126a0
mov ecx, edi
call fcn.004315b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00412640
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c33
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abce8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4ec008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x434338
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.004306b0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0
je 0x434329
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push 0
cmovae eax, dword [ebp - 0x38]
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x434329
test esi, esi
je 0x434329
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00412640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4c33
mov esp, ebp
pop ebp
ret 4
Function at 0x437bf0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac4b3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4ec008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00430c20
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043b8b0
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043b820
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043b8b0
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004207b0
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043b790
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043b790
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.0043b790
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea eax, [edi + 0x40]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x18
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [edi + 0x88], ecx
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], ax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437e10
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac5f3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ec008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 8
lea ecx, [ebx + 0x78]
call fcn.00412640
mov byte [ebp - 4], 7
lea ecx, [ebx + 0x40]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 7
call fcn.00412640
mov byte [ebp - 4], 6
lea esi, [ebx + 0x38]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xb
mov ecx, esi
call fcn.0043afd0
mov byte [ebp - 4], 6
push 0x38
push dword [esi]
call fcn.004a5002
add esp, 8
mov byte [ebp - 4], 5
lea esi, [ebx + 0x30]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xd
mov ecx, esi
call fcn.0043afd0
mov byte [ebp - 4], 5
push 0x38
push dword [esi]
call fcn.004a5002
add esp, 8
mov byte [ebp - 4], 4
lea esi, [ebx + 0x28]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xf
mov ecx, esi
call fcn.0043b0d0
mov byte [ebp - 4], 4
push 0x38
push dword [esi]
call fcn.004a5002
add esp, 8
mov byte [ebp - 4], 3
lea edi, [ebx + 0x20]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x12
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.00420830
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 3
push 0x40
push dword [edi]
call fcn.004a5002
add esp, 8
mov byte [ebp - 4], 2
lea edi, [ebx + 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x16
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.0043b690
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 2
push 0x30
push dword [edi]
call fcn.004a5002
add esp, 8
mov byte [ebp - 4], 1
lea esi, [ebx + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x18
mov ecx, esi
call fcn.0043b1c0
mov byte [ebp - 4], 1
push 0x28
push dword [esi]
call fcn.004a5002
add esp, 8
mov byte [ebp - 4], 0
lea edi, [ebx + 8]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x1b
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.0043b690
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 0
push 0x30
push dword [edi]
call fcn.004a5002
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0x1d
mov ecx, ebx
call fcn.00430890
mov dword [ebp - 4], 0xffffffff
push 0x54
push dword [ebx]
call fcn.004a5002
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret