joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436d2d
Capabilities:
Check for trap flag exception

Disassembly:
cmp esi, 0xf713
je 0x436d37
jne 0x436d37
pushal
xchg esi, edi
xchg edi, esi
call 0x436d41
push ebx
xor ebx, edi
pop ebx
pop edx
mov eax, 0xf9
verr si
push edi
xor edi, esi
pop edi
xchg esi, ecx
xchg ecx, esi
add eax, edx
push esi
lsl esi, edi
pop esi
push eax
lsl eax, edx
pop eax
push esi
push ebx
pop ebx
pop esi
push eax
push ebx
dec ebx
pop ebx
inc edx
dec edx
push eax
lar eax, ebx
pop eax
mov edx, 0
push dword fs:[edx]
fnop
mov dword fs:[edx], esp
cmp esi, 0xf713
je 0x436d88
jne 0x436d88
not ecx
not ecx
push eax
ror eax, cl
pop eax
mov ecx, 0
push ecx
neg ecx
pop ecx
xor ecx, 0xdbf
xor ecx, 0xdbf
div ecx
pushal
sub edx, 0x3bc
popal
push esi
str esi
pop esi
mov ecx, edx
pushfd
not esi
not esi
pushfd
push edi
push 0xc107
pop edi
pop edi
or dword [esp], 0x100
push ecx
inc ecx
pop ecx
popfd
inc edx
popfd
push edx
xor edx, 0x6183
pop edx
cmp edx, ecx
pushal
popal
je 0x436df9
add ecx, edx
sub ecx, edx
push 0x8caf1379
inc edi
dec edi
mov edx, 0xc12ade99
push esi
str esi
pop esi
ret
push edx
push esi
sub edx, esi
add esi, ebx
pop esi
pop edx
push esi
not esi
pop esi
mov ecx, 0
push edi
xor edi, 0x625a
pop edi
pushal
mov esi, ecx
sub ebx, esi
popal
pop dword fs:[ecx]
push esi
push ebx
pop ebx
pop esi
push ebx
push esi
pop esi
pop ebx
pop eax
pushal
add ebx, esi
popal
xor ecx, 0x4c68
xor ecx, 0x4c68
popal
jmp 0x436f53
push ebx
lsl ebx, esi
pop ebx
pushal
sub esi, ecx
mov edi, ecx
popal
push eax
wait
fnstsw ax
pop eax
push ebx
push esi
push ebx
pop ebx
pop esi
pushal
xor esi, 0x218b1edb
popal
pushal
nop
mov edx, 0x4ff6051f
sub ecx, 0x797a67d9
popal
push esi
call fcn.0043713b
pop es
int 6
in al, dx
mov dword [0x5b813d59], eax
shr edx, 1
imul byte [ecx + 0x7b]
rcr dword [eax + 0x43024a37], cl
in al, 0x5a
and edx, dword [edi]
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.004047b5
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.004047b5
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.004047b5
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.004047b5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.004047b5
mov dword [0x41203c], eax
call fcn.004047b5
test eax, eax
jge 0x402550
push 8
call fcn.004047b5
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.004047b5
pop ecx
push 1
call fcn.004047b5
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.004047b5
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.004047b5
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.004047b5
jmp 0x402495

Function at 0x4047b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4047c4
pop dword [ebp - 0x4c]
mov eax, 0xf3f8675d
sub eax, 0xf3b81f99
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x34bc0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xc63488be
sub ecx, 0xc63452b0
mov edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x4c]
mov esi, 0x2623ed7a
add esi, 0x728e59a
add dword [ebp - 4], eax
mov edx, dword [ebx]
sub edx, esi
sub dword [ebp - 0x30], edx
mov dword [edi], edx
xor dword [ebp - 0x48], ebx
add edi, 0xd1adeb3
sub edi, 0xd1adeaf
add ebx, 4
loop 0x404818
add eax, 0x99a42ea8
add eax, 0x665c9c63
xor ebx, ebx
add ebx, eax
add eax, 0x3bacc6b6
sub eax, 0x3bacc6b1
mov ecx, 0x630dce60
add ecx, 0x9d3231a0
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4144de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c83f
and dword [ebp - 0x14], 0
cmp dword [0x4225d8], 0
mov dword [ebp - 0x18], eax
jne 0x414591
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414639
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x414639
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4225d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4225dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4225e0], eax
call edi
push eax
call esi
mov dword [0x4225e8], eax
test eax, eax
je 0x414591
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4225e4], eax
mov eax, dword [0x4225e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4145ea
cmp dword [0x4225e8], ecx
je 0x4145ea
push eax
call esi
push dword [0x4225e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4145ea
test ebx, ebx
je 0x4145ea
call edi
test eax, eax
je 0x4145e1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4145e1
test byte [ebp - 8], 1
jne 0x4145ea
or dword [ebp + 0x10], 0x200000
jmp 0x41461d
mov eax, dword [0x4225dc]
cmp eax, dword [ebp - 0x18]
je 0x41461d
push eax
call esi
test eax, eax
je 0x41461d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41461d
mov eax, dword [0x4225e0]
cmp eax, dword [ebp - 0x18]
je 0x41461d
push eax
call esi
test eax, eax
je 0x41461d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4225d8]
call esi
test eax, eax
je 0x414639
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41463b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a7df
leave
ret

Function at 0x5d8ac9
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x5d87dc
add esi, ebx
or ebx, esi
mov esi, esi
call fcn.005d8afc
add ebx, esi
xor dword [ecx], edi
sub ebx, esi
add ebx, ebx
add ecx, 2
mov ebx, 0x54bc8335
cmp ecx, eax
jl fcn.005d8ac9
inc ebx
add ebx, esi
ret
Function at 0x862390
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x5ea015
lea edi, [esi - 0x1e8015]
push edi
jmp 0x8623aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8623b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8623a0
mov eax, 1
add ebx, ebx
jne 0x8623c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8623d4
jne 0x8623f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8623f3
dec eax
add ebx, ebx
jne 0x8623e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8623b8
add ebx, ebx
jne 0x8623ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x862445
xor ecx, ecx
sub eax, 3
jb 0x86240b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x86247a
sar eax, 1
mov ebp, eax
jmp 0x862416
add ebx, ebx
jne 0x862416
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8623e4
inc ecx
add ebx, ebx
jne 0x862424
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8623e4
add ebx, ebx
jne 0x862431
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x862426
jne 0x862442
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x862426
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x862464
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x862456
jmp 0x8623a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x862464
add edi, ecx
jmp 0x8623a6
pop esi
lea edi, [esi + 0x45e000]
mov eax, dword [edi]
or eax, eax
je 0x8624c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4a523c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4a528c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x862481
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4a5294]
or eax, eax
je 0x8624bd
mov dword [ebx], eax
add ebx, 4
jmp 0x86249e
call dword [esi + 0x4a5290]
mov ebp, dword [esi + 0x4a5298]
lea edi, [esi - 0x2000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8624f7
sub esp, 0xffffff80
jmp 0x538201

Function at 0x438ca6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
sub edi, edi
call fcn.00438ce6
and edi, ebx
sub edi, 0x67f227
or ebx, ebx
xor dword [esi], ecx
or edi, ebx
add ebx, 0xa236fdcb
add esi, 1
and edi, ebx
sub ebx, edi
cmp esi, eax
jne fcn.00438ca6
or edi, edi
ret
Function at 0x408940
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.0040896a
xor dword [ebx], edi
or edx, edx
or eax, edx
add ebx, 1
or edx, eax
cmp ebx, esi
jne fcn.00408940
push 0x69a25d3e
mov edx, dword [esp]
add esp, 4
or edx, eax
ret
Function at 0x405320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3be0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40546e
cmp byte [eax + 0x54], 0
je 0x40546e
add eax, 0x1c
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call fcn.004042b0
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x40538a
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40543b
push 0
mov edx, edi
lea ecx, [ebp - 0x34]
call fcn.0047c9e0
add esp, 4
push 2
push 0
push 0
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x38]
push 0
push ecx
push dword [ebp - 0x24]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x405425
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40541b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40548b
push edx
push ecx
call fcn.004bc94a
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov byte [ebp - 4], 0
mov dword [ebp - 4], 7
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x405460
cmp byte [ebp - 0x18], 0
je 0x405460
mov eax, dword [esi]
test eax, eax
je 0x40545c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret 4
call fcn.004c24f9
int3
Function at 0x407e90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3e61
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x208
xor esi, esi
push esi
push eax
call fcn.004bf3c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x103
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x407f6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5339fc], 0
mov esi, eax
je 0x4080cf
push ecx
mov ecx, 0x5339f8
call fcn.004043d0
mov eax, dword [0x5339fc]
cmp byte [eax + 0x54], 0
je 0x4080cf
cmp dword [eax + 0x58], 2
jb 0x4080cf
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x234]
push 0x50adcc
push eax
call fcn.0046e5e0
add esp, 0xc
push 0x132
jmp 0x408092
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.2345InstDll.dll
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x40800d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5339fc], 0
mov esi, eax
je 0x4080cf
push ecx
mov ecx, 0x5339f8
call fcn.004043d0
mov eax, dword [0x5339fc]
cmp byte [eax + 0x54], 0
je 0x4080cf
cmp dword [eax + 0x58], 2
jb 0x4080cf
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push esi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push 0x50ae54
push eax
call fcn.0046e5e0
add esp, 0xc
push 0x13b
jmp 0x408092
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4080cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5339fc], 0
mov esi, eax
je 0x4080cf
push ecx
mov ecx, 0x5339f8
call fcn.004043d0
mov eax, dword [0x5339fc]
cmp byte [eax + 0x54], 0
je 0x4080cf
cmp dword [eax + 0x58], 2
jb 0x4080cf
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 2
push 0x50ae7c
push eax
call fcn.0046e5e0
add esp, 0xc
push 0x142
push str.RC::RCInstExecuter::GetDllPath
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src2345instdll_rcinstexecuter.cpp
lea eax, [ebp - 0x234]
mov ecx, 0x5339f8
push eax
push 2
call fcn.00404fd0
test bl, bl
je 0x4080c4
lea eax, [ebp - 0x234]
mov ecx, 0x5339f8
push eax
call fcn.00405320
lea ecx, [ebp - 0x234]
call fcn.00402880
test esi, esi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret 4
Function at 0x41af50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e76f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.004c5f22
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x41b02a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.00414620
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00405520
test al, al
jne 0x41b01b
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41b01b
test esi, esi
je 0x41b01b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004027f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret 4
Function at 0x41e430
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7dad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x533068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402850
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402850
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402850
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402850
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.00402850
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.00402850
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.00402850
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.00402850
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.00402850
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.00402850
mov byte [ebp - 4], 9
lea ecx, [esi + 0xf0]
call fcn.00402850
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x108]
call fcn.00402850
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x120]
call fcn.00402850
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x138]
call fcn.00402850
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x150]
call fcn.00402850
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x168]
call fcn.00402850
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x180]
call fcn.00402850
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x198]
call fcn.00402850
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x1b0]
call fcn.00402850
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x1c8]
call fcn.00402850
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1e0]
call fcn.00402850
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0x1f8]
call fcn.00402850
mov byte [ebp - 4], 0x15
lea ecx, [esi + 0x210]
call fcn.00402850
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e5c0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7dad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x533068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x15
lea ecx, [esi + 0x210]
call fcn.004027f0
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0x1f8]
call fcn.004027f0
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1e0]
call fcn.004027f0
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x1c8]
call fcn.004027f0
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x1b0]
call fcn.004027f0
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x198]
call fcn.004027f0
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x180]
call fcn.004027f0
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x168]
call fcn.004027f0
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x150]
call fcn.004027f0
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x138]
call fcn.004027f0
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x120]
call fcn.004027f0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x108]
call fcn.004027f0
mov byte [ebp - 4], 9
lea ecx, [esi + 0xf0]
call fcn.004027f0
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.004027f0
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.004027f0
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.004027f0
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.004027f0
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.004027f0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.004027f0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.004027f0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004027f0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004027f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424ae0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e91ab
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x533068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00414b30
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004289b0
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00428910
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004289b0
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00428870
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004287d0
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004287d0
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.004287d0
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea ecx, [edi + 0x40]
call fcn.00405960
mov byte [ebp - 4], 0x18
lea ecx, [edi + 0x78]
call fcn.00402850
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret