joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41671e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x4166ab
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp 0x41650f
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x4165c1
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x4165c1
push esi
and esi, 0x143cb
sub esi, 0x544f
sub esi, 0x1169b
pop esi
push edx
push eax
add esp, 4
xor edx, 0x6737
and edx, 0x14e01
sub edx, 0x117be
sub edx, 0x128c9
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x4165b3
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x180]
movsx ecx, byte [ebp + eax - 0x820]
cmp edx, ecx
jne 0x4165ba
jmp 0x416500
jmp 0x4165c1
push edi
jmp 0x4165c8
or edi, 0x455d
pop edi
push eax
jmp 0x4165d8
pop eax
push eax
and eax, 0x17028
and eax, 0x46b1
pop eax
push eax
push esi
add esp, 4
add eax, 0x2f1d
pop eax
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
cmp eax, edx
jne 0x416620
mov dword [ebp - 0xc30], 0
jmp 0x41668f
push edx
or edx, 0xc642
pop edx
push esi
add esi, 0x16ea1
pop esi
push edx
jmp 0x416639
pop edx
push ebx
or ebx, 0xc41b
call fcn.0041664e
add byte [edi], bh
dec ebp
inc ebx
aas
dec edx
inc ebp
add esp, 4
add esp, 4
add esp, 4
pop ebx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x416685
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x41668f
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x4166a6
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x4166b7
jmp 0x416490
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
cmp dword [ebp - 0x3c4], 0
je 0x416792
push edx
push esi
add esp, 4
add edx, 0x1768b
xor edx, 0x3562
or edx, 0x125ba
jmp 0x4166e3
pop edx
push eax
push edx
add esp, 4
add eax, 0x28af
add eax, 0x542e
pop eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x18b0], eax
push ebx
sub ebx, 0x12f69
pop ebx
push edi
push edi
add esp, 4
call 0x41671e
add byte [ebx + 0x48], al
xor esi, dword [edi]
cmp al, 0x3e
dec eax
aaa
inc edx
add esp, 4
call 0x416730
add byte [edx + eax*2 + 0x32], al
cmp al, 0x50
xor al, 0x49
dec ecx
cmp dword [ebx - 0x74a0fb3c], eax
lea edx, [eax - 0x19]
invalid
Function at 0x416730
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x4166ab
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp 0x41650f
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x4165c1
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x4165c1
push esi
and esi, 0x143cb
sub esi, 0x544f
sub esi, 0x1169b
pop esi
push edx
push eax
add esp, 4
xor edx, 0x6737
and edx, 0x14e01
sub edx, 0x117be
sub edx, 0x128c9
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x4165b3
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x180]
movsx ecx, byte [ebp + eax - 0x820]
cmp edx, ecx
jne 0x4165ba
jmp 0x416500
jmp 0x4165c1
push edi
jmp 0x4165c8
or edi, 0x455d
pop edi
push eax
jmp 0x4165d8
pop eax
push eax
and eax, 0x17028
and eax, 0x46b1
pop eax
push eax
push esi
add esp, 4
add eax, 0x2f1d
pop eax
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
cmp eax, edx
jne 0x416620
mov dword [ebp - 0xc30], 0
jmp 0x41668f
push edx
or edx, 0xc642
pop edx
push esi
add esi, 0x16ea1
pop esi
push edx
jmp 0x416639
pop edx
push ebx
or ebx, 0xc41b
call fcn.0041664e
add byte [edi], bh
dec ebp
inc ebx
aas
dec edx
inc ebp
add esp, 4
add esp, 4
add esp, 4
pop ebx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x416685
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x41668f
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x4166a6
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x4166b7
jmp 0x416490
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
cmp dword [ebp - 0x3c4], 0
je 0x416792
push edx
push esi
add esp, 4
add edx, 0x1768b
xor edx, 0x3562
or edx, 0x125ba
jmp 0x4166e3
pop edx
push eax
push edx
add esp, 4
add eax, 0x28af
add eax, 0x542e
pop eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x18b0], eax
push ebx
sub ebx, 0x12f69
pop ebx
push edi
push edi
add esp, 4
call 0x41671e
add byte [ebx + 0x48], al
xor esi, dword [edi]
cmp al, 0x3e
dec eax
aaa
inc edx
add esp, 4
call 0x416730
add byte [edx + eax*2 + 0x32], al
cmp al, 0x50
xor al, 0x49
dec ecx
cmp dword [ebx - 0x74a0fb3c], eax
lea edx, [eax - 0x19]
invalid
Function at 0x416771
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x129a
pop edx
push edx
sub edx, 0x12de5
pop edx
mov dword [ebp - 0x738], 0
jmp 0x416e7c
Function at 0x417e54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00417e41
add byte [edi], dh
dec eax
dec esi
inc esi
inc ebp
inc ebx
xor eax, 0x4c4833d
invalid
add esp, 4
add esp, 4
or ebx, 0x98f1
or ebx, 0xc7b9
pop ebx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
dec dword [ebx - 0xc636b]
inc dword [ebx - 0x6a76fd3e]
pushfd
invalid
invalid
jmp dword [esi - 0x75]
test dword [eax + esi*8 - 1], ebp
jmp dword [esi - 0x77]
inc ebp
rcl byte [edi - 0x7f], 0xe7
shl byte [edi], 0
add edi, 0x166ce
pop edi
push ebx
push ebx
add esp, 4
add ebx, 0x9d78
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xf57e
pop ebx
push edi
push ebx
add esp, 4
and edi, 0x1524
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x417f0a
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x417f64
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x417e32
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x417e32
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x417f4e
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x417f58
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x417fad
push edi
push ebx
add esp, 4
sub edi, 0x34ea
pop edi
push ebx
call 0x417f87
add byte [edi], dh
inc edi
dec edx
xor al, 0x4a
cmp dword [ebx + eax*4 - 0x3c], eax
add al, 0x5b
push esi
call 0x417f9b
add byte [edi], dh
inc edx
xor al, 0x38
cmp al, 0x33
push eax
cmp eax, 0x4c4833d
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x418015
push eax
push edx
add esp, 4
jmp 0x417fb8
pop eax
push esi
and esi, 0xb2b3
or esi, 0x69ed
and esi, 0xa5a0
pop esi
push eax
push eax
add esp, 4
sub eax, 0xb653
add eax, 0x9ad1
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41800b
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x417dd6
mov dword [ebp - 0x2a8], 0

Function at 0x417ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0xc636b]
inc dword [ebx - 0x6a76fd3e]
pushfd
invalid
Function at 0x417f87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00417e41
add byte [edi], dh
dec eax
dec esi
inc esi
inc ebp
inc ebx
xor eax, 0x4c4833d
invalid
add esp, 4
add esp, 4
or ebx, 0x98f1
or ebx, 0xc7b9
pop ebx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
dec dword [ebx - 0xc636b]
inc dword [ebx - 0x6a76fd3e]
pushfd
invalid
invalid
jmp dword [esi - 0x75]
test dword [eax + esi*8 - 1], ebp
jmp dword [esi - 0x77]
inc ebp
rcl byte [edi - 0x7f], 0xe7
shl byte [edi], 0
add edi, 0x166ce
pop edi
push ebx
push ebx
add esp, 4
add ebx, 0x9d78
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xf57e
pop ebx
push edi
push ebx
add esp, 4
and edi, 0x1524
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x417f0a
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x417f64
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x417e32
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x417e32
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x417f4e
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x417f58
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x417fad
push edi
push ebx
add esp, 4
sub edi, 0x34ea
pop edi
push ebx
call 0x417f87
add byte [edi], dh
inc edi
dec edx
xor al, 0x4a
cmp dword [ebx + eax*4 - 0x3c], eax
add al, 0x5b
push esi
call 0x417f9b
add byte [edi], dh
inc edx
xor al, 0x38
cmp al, 0x33
push eax
cmp eax, 0x4c4833d
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x418015
push eax
push edx
add esp, 4
jmp 0x417fb8
pop eax
push esi
and esi, 0xb2b3
or esi, 0x69ed
and esi, 0xa5a0
pop esi
push eax
push eax
add esp, 4
sub eax, 0xb653
add eax, 0x9ad1
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41800b
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x417dd6
mov dword [ebp - 0x2a8], 0
Function at 0x417f9b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00417e41
add byte [edi], dh
dec eax
dec esi
inc esi
inc ebp
inc ebx
xor eax, 0x4c4833d
invalid
add esp, 4
add esp, 4
or ebx, 0x98f1
or ebx, 0xc7b9
pop ebx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
dec dword [ebx - 0xc636b]
inc dword [ebx - 0x6a76fd3e]
pushfd
invalid
invalid
jmp dword [esi - 0x75]
test dword [eax + esi*8 - 1], ebp
jmp dword [esi - 0x77]
inc ebp
rcl byte [edi - 0x7f], 0xe7
shl byte [edi], 0
add edi, 0x166ce
pop edi
push ebx
push ebx
add esp, 4
add ebx, 0x9d78
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xf57e
pop ebx
push edi
push ebx
add esp, 4
and edi, 0x1524
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x417f0a
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x417f64
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x417e32
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x417e32
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x417f4e
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x417f58
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x417fad
push edi
push ebx
add esp, 4
sub edi, 0x34ea
pop edi
push ebx
call 0x417f87
add byte [edi], dh
inc edi
dec edx
xor al, 0x4a
cmp dword [ebx + eax*4 - 0x3c], eax
add al, 0x5b
push esi
call 0x417f9b
add byte [edi], dh
inc edx
xor al, 0x38
cmp al, 0x33
push eax
cmp eax, 0x4c4833d
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x418015
push eax
push edx
add esp, 4
jmp 0x417fb8
pop eax
push esi
and esi, 0xb2b3
or esi, 0x69ed
and esi, 0xa5a0
pop esi
push eax
push eax
add esp, 4
sub eax, 0xb653
add eax, 0x9ad1
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41800b
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x417dd6
mov dword [ebp - 0x2a8], 0
Function at 0x42c090
Capabilities:
Encode data using xor

Disassembly:
daa
push es
push es
push es
inc edx
enter 0x1384, 0xffffffffffffffce
mov word [edi], gs
push es
push es
push es
push es
push es
push es
adc esi, ecx
mov word [edi], gs
push es
push es
or byte [edi], al
pop es
pop es
xchg edx, eax
pushfd
das
push es
push es
nop
pushfd
sub esi, ebx
push es
push es
mov al, ah
sub esi, ebx
push es
push es
pop es
jl 0x42c10a
pop ebp
mov ch, cl
adc byte [edi], al
or byte [edi], al
mov ch, cl
mov esi, 0x6507086e
pop ebp
push edi
mov cl, bl
or ecx, dword [eax + 0x83221f5]
pop es
pop edx
push edi
mov cl, bl
or ecx, dword [eax + 0x74578fa]
pop es
mov dl, cl
cmp byte [eax - 0x2d77f8f9], dh
outsd dx, dword [esi]
sub dword [edi], eax
pop es
bound edx, qword [edx + 0x6026b8c]
push es
nop
invalid
lodsd eax, dword [esi]
leave
pop es
pop es
mov al, ch
insd dword es:[edi], dx
inc ebx
pop es
pop es
pushal
pop esi
push edi
mov cl, bl
or ebp, edi
adc dword [edi], eax
pop es
pop es
pop es
dec ebp
cmp al, byte [edx + 0x4b]
cmp eax, 0x3d553b42
mov cl, bl
or esp, dword [esi + 0x59]
mov cl, bh
movsb byte es:[edi], byte [esi]
mov ecx, dword [eax]
pop es
popal
xchg edx, eax
xchg esp, eax
imul eax, dword [edx], 6
push es
xchg edx, eax
sbb byte [eax + 0x6026b9c], dl
push es
xchg edx, eax
mov word [ebx + 2], gs
push es
push es
inc edx
mov word [ebx], es
test dword [esi], 0x92177b06
xchg esp, eax
imul eax, dword [edx], 6
push es
mov al, byte [eax - 0x73e9f8c9]
mov ebp, 0xce060604
invalid

Function at 0x4388f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dedcb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x51ec70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
lea ecx, [edi + 0x18]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.00406670
lea eax, [esi + 0x30]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x30]
call fcn.00406670
movzx eax, byte [esi + 0x48]
mov byte [edi + 0x48], al
movzx eax, byte [esi + 0x49]
mov byte [edi + 0x49], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43a820
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4df249
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x51ec70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CSiteHelper.0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00470ee0
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00470ee0
mov dword [esi], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
push 0x43ed40
push 0x43a7f0
push 2
push 8
lea eax, [edi + 0x40]
mov byte [ebp - 4], 5
push eax
call fcn.004ab830
push fcn.0043db90
push 0x439c00
push 2
push 0xc
lea eax, [edi + 0x50]
mov byte [ebp - 4], 6
push eax
call fcn.004ab830
lea esi, [edi + 0x68]
mov byte [ebp - 4], 7
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00470e60
mov dword [esi], eax
lea esi, [edi + 0x70]
mov byte [ebp - 4], 8
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00470e60
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43af70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4df343
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51ec70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00406430
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00406430
mov eax, dword [esi + 0x30]
lea ecx, [edi + 0x40]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov al, byte [esi + 0x3c]
mov byte [edi + 0x3c], al
lea eax, [esi + 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.00406430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x443230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfb70
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 0x58]
push esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x50]
mov edx, dword [ebx + 0x30]
mov dword [ebp - 4], 0
mov eax, dword [ecx + 4]
cmp byte [eax + 0xd], 0
jne 0x44333a
cmp dword [eax + 0x10], edx
jae 0x443291
mov eax, dword [eax + 8]
jmp 0x443295
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x443287
cmp ecx, dword [edi + 0x50]
je 0x44333a
cmp edx, dword [ecx + 0x10]
jb 0x44333a
mov eax, dword [ebx + 0x38]
cmp eax, 6
je 0x443363
cmp eax, 7
je 0x443363
cmp eax, 0x23
je 0x443363
test eax, eax
jne 0x44332e
cmp dword [edi + 0x80], 0xffffffff
je 0x44332e
cmp dword [edi + 0x84], eax
je 0x44332e
mov ecx, dword [edi + 0x78]
mov eax, 0x6bca1af3
sub ecx, dword [edi + 0x74]
imul ecx
mov ecx, dword [edi + 0x80]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jge 0x44332e
mov eax, dword [edi + 0x84]
imul ecx, ecx, 0x4c
cmp eax, 1
mov dword [edi + 0x100], eax
mov eax, dword [edi + 0x74]
jne 0x44331d
add eax, 0x1c
jmp 0x443320
add eax, 0x34
add eax, ecx
lea ecx, [edi + 0xe8]
push eax
call fcn.00440890
push 0
push dword [ebx + 0x30]
mov ecx, edi
call fcn.00466720
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret 4
lea ecx, [edi + 0x90]
cmp ecx, ebx
je 0x443386
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x443377
mov eax, dword [ebx]
push dword [ebx + 0x10]
push eax
call fcn.004196d0
lea ecx, [edi + 0x90]
lea edx, [ecx + 0x18]
lea eax, [ebx + 0x18]
mov dword [ebp - 0x2c], edx
cmp edx, eax
je 0x4433af
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x44339d
mov edx, dword [eax]
push dword [eax + 0x10]
mov ecx, dword [ebp - 0x2c]
push edx
call fcn.004196d0
lea ecx, [edi + 0x90]
mov eax, dword [ebx + 0x30]
mov dword [ecx + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [ecx + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [ecx + 0x38], eax
mov al, byte [ebx + 0x3c]
mov byte [ecx + 0x3c], al
lea eax, [ebx + 0x40]
add ecx, 0x40
cmp ecx, eax
je 0x4433e4
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x4433db
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004196d0
lea eax, [edi + 0xd0]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406430
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push dword [ebx + 0x30]
mov ecx, edi
call fcn.004469d0
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00407530
jmp 0x44333c