joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486029
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
call fcn.00424cc0
add esp, 4
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.00424d80
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], 1
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0047ff74
add esp, 0x28
ret

Function at 0x425f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4862c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
lea esi, [edi + 0x58]
mov dword [esp + 0xc], 0x402
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], esi
test esi, esi
je 0x425f62
mov eax, dword [esi]
test eax, eax
je 0x425f62
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x28], 0
lea eax, [esp + 0xc]
push eax
lea ecx, [edi + 0x5c]
call fcn.004275f0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x425f85
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esp + 0x28], 0xffffffff
test esi, esi
je 0x425fa6
mov eax, dword [esi]
test eax, eax
je 0x425f9e
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0047ff74
add esp, 0x20
ret 4
Function at 0x4263e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4863c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ebx, [esi + 0xc]
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x426435
mov eax, dword [ebx]
test eax, eax
je 0x426435
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
push esi
lea ecx, [esp + 0x20]
movq qword [esp + 0x20], xmm0
mov dword [esp + 0x28], 0
call fcn.00427460
mov byte [esp + 0x38], 1
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x426476
mov eax, dword [ebx]
test eax, eax
je 0x426470
push eax
call esi
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x1c]
mov edi, eax
cmp eax, dword [esp + 0x20]
je 0x426554
mov ebx, dword [esp + 0x10]
lea ebx, [ebx]
lea esi, [ebx + 0xc]
mov dword [esp + 0x18], esi
test esi, esi
je 0x4264a8
mov eax, dword [esi]
test eax, eax
je 0x4264a8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x42651b
mov edx, dword [eax]
mov dword [esp + 0x10], edx
test edx, edx
je 0x4264c4
cmp edx, dword [edi]
je 0x4264cd
add eax, 0x18
cmp eax, ecx
jne 0x4264b6
jmp 0x42651b
push eax
call fcn.004269d0
test al, al
je 0x4264fb
test esi, esi
je 0x4264ee
mov eax, dword [esi]
test eax, eax
je 0x4264e8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov dword [esp + 0x18], esi
push dword [esp + 0x10]
mov ecx, ebx
call fcn.00426e10
jmp 0x42651b
test esi, esi
je 0x426512
mov eax, dword [esi]
test eax, eax
je 0x42650c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x10]
call fcn.00422000
mov byte [esp + 0x38], 1
test esi, esi
je 0x426539
mov eax, dword [esi]
test eax, eax
je 0x426531
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x18], 0
add edi, 0x18
cmp edi, dword [esp + 0x20]
jne 0x426490
mov ebx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x38], 0
test eax, eax
je 0x42657f
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], 0xffffffff
test ebx, ebx
je 0x42659c
mov eax, dword [ebx]
test eax, eax
je 0x426594
push eax
call esi
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0047ff74
mov esp, ebp
pop ebp
ret
Function at 0x4267e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x486408
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
lea ebx, [edi + 0xc]
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x426835
mov eax, dword [ebx]
test eax, eax
je 0x426835
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 1
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x42689a
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x14]
lea esp, [esp]
cmp edi, dword [esi]
jne 0x426892
push esi
lea ecx, [esp + 0x1c]
call fcn.00427520
mov eax, dword [esp + 0x14]
add esi, 0x18
cmp esi, dword [eax + 4]
jne 0x426880
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x4268b3
mov eax, dword [ebx]
test eax, eax
je 0x4268ad
push eax
call esi
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x18]
mov edi, eax
cmp eax, dword [esp + 0x1c]
je 0x426962
mov ebx, dword [esp + 0x14]
lea esi, [ebx + 0xc]
mov dword [esp + 0x14], esi
test esi, esi
je 0x4268df
mov eax, dword [esi]
test eax, eax
je 0x4268df
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x426929
lea ecx, [ecx]
mov edx, dword [eax]
mov dword [esp + 0x10], edx
test edx, edx
je 0x4268fe
cmp edx, dword [edi]
je 0x426907
add eax, 0x18
cmp eax, ecx
jne 0x4268f0
jmp 0x426929
test esi, esi
je 0x426922
mov eax, dword [esi]
test eax, eax
je 0x42691c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0x14], esi
mov ecx, edx
call fcn.00422000
mov byte [esp + 0x38], 1
test esi, esi
je 0x426947
mov eax, dword [esi]
test eax, eax
je 0x42693f
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], 0
add edi, 0x18
cmp edi, dword [esp + 0x1c]
jne 0x4268c7
mov ebx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x38], 0
test eax, eax
je 0x42698d
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
test ebx, ebx
je 0x4269aa
mov eax, dword [ebx]
test eax, eax
je 0x4269a2
push eax
call esi
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0047ff74
mov esp, ebp
pop ebp
ret 4
Function at 0x426b50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486499
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.004030c0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.004030c0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.004030c0
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.004030c0
mov byte [esp + 0x18], 3
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x429030
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, ecx
push edi
mov edi, dword [esp + 0x18]
mov dword [ebx], 0
cmp dword [ebp], 0xffffffff
jne 0x42906d
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0047ff74
add esp, 8
ret 0xc
push esi
mov esi, dword [esp + 0x20]
mov ecx, 0x100000
jmp 0x429080
cmp esi, 0x100000
mov dword [esp + 0x10], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
add dword [ebx], ecx
test al, al
je 0x4290da
test ecx, ecx
je 0x4290c3
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x429080
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0047ff74
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x14]
xor al, al
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047ff74
add esp, 8
ret 0xc
Function at 0x4293b0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x4293de
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0047ff74
add esp, 8
ret 4
push esi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x429419
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x429419
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0047ff74
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.0047ff74
add esp, 8
ret 4

Function at 0x42a850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486b39
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
push 0x18
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [edi + 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x38], 0
lea esi, [edi + 0x24]
mov dword [esi], 0
xor eax, eax
mov byte [esi + 4], 0
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov dword [esp + 0x14], esi
mov word [esi + 8], ax
mov byte [esp + 0x38], 2
lea ecx, [esp + 0x18]
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x14], 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push 0x492958
mov byte [edi + 8], al
mov dword [edi + 0x18], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x1c], eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov word [esp + 0x20], ax
call fcn.00402f90
mov byte [esp + 0x38], 3
mov eax, dword [esi]
test eax, eax
je 0x42a91b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 0
mov dword [esi], 0
jne 0x42a92c
xor eax, eax
jmp 0x42a93a
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea ecx, [esi + 8]
sete al
mov byte [esi + 4], al
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x42a96f
push 0xffffffffffffffff
push 0
push eax
call fcn.004030c0
mov byte [esp + 0x38], 2
cmp dword [esp + 0x2c], 8
jb 0x42a988
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x42ae00
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x486c48
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x42ae42
xor al, al
jmp 0x42af08
add edi, 0x20
mov dword [esp + 0x14], edi
je 0x42ae58
mov eax, dword [edi]
test eax, eax
je 0x42ae58
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x24], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x42aee3
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea ebx, [esi + 4]
push 1
push ebx
call ebp
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x42a9c0
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
je 0x42aecc
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x42aeb7
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x42aecc
mov bl, 1
jmp 0x42aee5
push 0xffffffffffffffff
push ebx
call ebp
dec eax
jne 0x42aedb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.0042ab70
xor bl, bl
mov dword [esp + 0x24], 0xffffffff
test edi, edi
je 0x42af06
mov eax, dword [edi]
test eax, eax
je 0x42aefe
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0047ff74
add esp, 0x14
ret
Function at 0x42b160
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x486e03
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0
push 0
mov dword [esp + 0x18], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00423600
mov dword [edi], eax
mov dword [esp + 0x1c], 2
lea esi, [edi + 8]
mov dword [esp + 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430990
mov dword [esi], eax
mov byte [esp + 0x1c], 7
lea esi, [edi + 0x10]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430830
mov dword [esi], eax
mov byte [esp + 0x1c], 0xa
lea esi, [edi + 0x18]
mov dword [esp + 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430990
mov dword [esi], eax
mov byte [esp + 0x1c], 0xf
lea esi, [edi + 0x20]
mov dword [esp + 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00430a40
mov dword [esi], eax
mov byte [esp + 0x1c], 0x14
lea esi, [edi + 0x28]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004308e0
mov dword [esi], eax
mov byte [esp + 0x1c], 0x17
lea esi, [edi + 0x30]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004308e0
mov dword [esi], eax
mov byte [esp + 0x1c], 0x1a
lea esi, [edi + 0x38]
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004308e0
mov dword [esi], eax
mov byte [esp + 0x1c], 0x1d
lea eax, [edi + 0x40]
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov dword [esp + 0x10], eax
mov word [eax], cx
mov byte [esp + 0x1c], 0x1e
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [esp + 0x1c], 0x1f
xor eax, eax
mov dword [edi + 0x84], 7
mov dword [edi + 0x80], ecx
mov word [edi + 0x70], ax
mov dword [esp + 0x1c], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x42b6c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x487008
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push dword [eax + 4]
call fcn.0042fe70
mov eax, dword [ebx + 8]
lea ecx, [ebx + 0x18]
mov dword [eax + 4], eax
mov eax, dword [ebx + 8]
mov dword [eax], eax
mov eax, dword [ebx + 8]
mov dword [eax + 8], eax
mov dword [ebx + 0xc], 0
mov eax, dword [ebx + 0x18]
push dword [eax + 4]
call fcn.0042fe70
mov eax, dword [ebx + 0x18]
lea ecx, [ebx + 0x10]
mov dword [eax + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [eax], eax
mov eax, dword [ebx + 0x18]
mov dword [eax + 8], eax
mov dword [ebx + 0x1c], 0
call fcn.0042fb10
mov eax, dword [ebx + 0x20]
lea ecx, [ebx + 0x20]
push dword [eax + 4]
call fcn.0042ff20
mov eax, dword [ebx + 0x20]
lea ecx, [ebx + 0x28]
mov dword [eax + 4], eax
mov eax, dword [ebx + 0x20]
mov dword [eax], eax
mov eax, dword [ebx + 0x20]
mov dword [eax + 8], eax
mov dword [ebx + 0x24], 0
call fcn.0042fc90
mov eax, dword [ebx + 0x30]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x30]
mov dword [eax + 4], eax
mov dword [ebx + 0x34], 0
cmp esi, dword [ebx + 0x30]
je 0x42b7a7
mov ebp, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
lea ebx, [ebx]
mov edi, dword [esi]
lea ecx, [esi + 8]
call fcn.0042c3f0
push esi
call ebp
add esp, 4
mov esi, edi
cmp edi, dword [ebx + 0x30]
jne 0x42b790
push 0
push 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.00423600
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], 2
lea eax, [esp + 0x18]
cmp ebx, eax
je 0x42b7ee
mov ecx, dword [ebx]
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 4]
mov dword [ebx + 4], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00423270
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x432b30
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x487fd5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, edx
mov dword [esp + 0x1c], ebx
mov edi, ecx
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x17]
push eax
mov ecx, esi
mov byte [esp + 0x1b], 7
call fcn.00432d70
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 2
push eax
mov ecx, esi
call fcn.00432d70
mov eax, ebx
mov ecx, esi
shr eax, 0x18
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
call fcn.00432d70
mov eax, ebx
mov ecx, esi
shr eax, 0x10
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
call fcn.00432d70
mov eax, ebx
mov ecx, esi
shr eax, 8
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
call fcn.00432d70
lea eax, [esp + 0x17]
mov byte [esp + 0x17], bl
push eax
mov ecx, esi
call fcn.00432d70
mov dword [esp + 0x18], 0
test ebx, ebx
je 0x432cbb
mov eax, dword [esi + 4]
cmp edi, eax
jae 0x432c58
mov ebx, dword [esi]
cmp ebx, edi
ja 0x432c58
mov edx, dword [esi + 8]
mov ebp, edi
sub ebp, ebx
cmp eax, edx
jne 0x432c38
mov ecx, edx
sub ecx, eax
cmp ecx, 1
jae 0x432c38
mov ecx, ebx
sub ecx, eax
dec ecx
cmp ecx, 1
jb 0x432ccf
sub eax, ebx
sub edx, ebx
mov ebx, edx
or ecx, 0xffffffff
shr ebx, 1
inc eax
sub ecx, ebx
cmp ecx, edx
jae 0x432c29
xor edx, edx
jmp 0x432c2b
add edx, ebx
cmp edx, eax
mov ecx, esi
cmovb edx, eax
push edx
call fcn.00423530
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x28], 0
test ecx, ecx
je 0x432c4e
mov al, byte [eax + ebp]
mov byte [ecx], al
mov dword [esp + 0x28], 0xffffffff
jmp 0x432ca4
mov edx, dword [esi + 8]
cmp eax, edx
jne 0x432c99
mov ecx, edx
sub ecx, eax
cmp ecx, 1
jae 0x432c99
mov ebx, dword [esi]
mov ecx, ebx
sub ecx, eax
dec ecx
cmp ecx, 1
jb 0x432ccf
sub eax, ebx
sub edx, ebx
mov ebx, edx
or ecx, 0xffffffff
shr ebx, 1
inc eax
sub ecx, ebx
cmp ecx, edx
jae 0x432c8a
xor edx, edx
jmp 0x432c8c
add edx, ebx
cmp edx, eax
mov ecx, esi
cmovb edx, eax
push edx
call fcn.00423530
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x432ca4
mov al, byte [edi]
mov byte [ecx], al
mov ecx, dword [esp + 0x18]
inc edi
inc dword [esi + 4]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [esp + 0x1c]
jb 0x432be4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x436e40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x488737
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 4], ecx
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov dword [esp + 8], ecx
mov word [ecx], ax
mov dword [esp + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov dword [esp + 0x14], 1
lea eax, [ecx + 0x30]
mov byte [eax], 0
xor edx, edx
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], 0
mov dword [esp + 8], eax
mov word [eax + 4], dx
mov byte [esp + 0x14], 2
mov dword [eax + 0x30], 7
mov dword [eax + 0x2c], edx
mov word [eax + 0x1c], dx
mov byte [esp + 0x14], 3
mov dword [eax + 0x48], 7
mov dword [eax + 0x44], edx
mov word [eax + 0x34], dx
mov byte [esp + 0x14], 4
mov dword [eax + 0x60], 7
mov dword [eax + 0x5c], edx
mov word [eax + 0x4c], dx
mov dword [esp + 0x14], 0xffffffff
mov eax, ecx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret