joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ca17f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b6bc4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x104b7cc4
mov eax, dword [esi + 0x88]
push eax
mov eax, dword [esi + 0x84]
mov dword [esp + 0x1c], 0xb
call eax
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
push eax
mov byte [esp + 0x20], 0xa
call ecx
mov eax, dword [esi + 0x78]
mov edx, dword [esi + 0x74]
push eax
mov byte [esp + 0x24], 9
call edx
mov eax, dword [esi + 0x70]
push eax
mov eax, dword [esi + 0x6c]
mov byte [esp + 0x28], 8
call eax
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x64]
push eax
mov byte [esp + 0x2c], 7
call ecx
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x5c]
push eax
mov byte [esp + 0x30], 6
call edx
mov eax, dword [esi + 0x58]
push eax
mov eax, dword [esi + 0x54]
mov byte [esp + 0x34], 5
call eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
push eax
mov byte [esp + 0x38], 4
call ecx
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x44]
push eax
mov byte [esp + 0x3c], 3
call edx
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x3c]
mov byte [esp + 0x40], 2
call eax
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
push ecx
mov byte [esp + 0x44], 1
call edx
lea edi, [esi + 0x1c]
add esp, 0x2c
mov ecx, edi
call fcn.0058590f
mov eax, dword [edi + 0xc]
test eax, eax
je 0x6ca271
push eax
call fcn.00776c58
add esp, 4
mov eax, dword [edi]
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00776c58
add esp, 4
lea ecx, [esi + 4]
call fcn.00580d5f
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x6cb66f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b728f
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], 0x104b7cf4
mov eax, dword [esi + 0x114]
push eax
mov eax, dword [esi + 0x110]
mov dword [esp + 0x20], 0x15
call eax
mov eax, dword [esi + 0x10c]
mov ecx, dword [esi + 0x108]
push eax
mov byte [esp + 0x24], 0x14
call ecx
add esp, 8
lea ecx, [esi + 0xec]
mov byte [esp + 0x1c], 0x13
call fcn.006107ff
mov eax, dword [esi + 0xe8]
mov edx, dword [esi + 0xe4]
push eax
mov byte [esp + 0x20], 0x12
call edx
mov eax, dword [esi + 0xe0]
push eax
mov eax, dword [esi + 0xdc]
mov byte [esp + 0x24], 0x11
call eax
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xd4]
push eax
mov byte [esp + 0x28], 0x10
call ecx
mov eax, dword [esi + 0xd0]
mov edx, dword [esi + 0xcc]
push eax
mov byte [esp + 0x2c], 0xf
call edx
mov eax, dword [esi + 0xc8]
push eax
mov eax, dword [esi + 0xc4]
mov byte [esp + 0x30], 0xe
call eax
mov eax, dword [esi + 0xc0]
mov ecx, dword [esi + 0xbc]
push eax
mov byte [esp + 0x34], 0xd
call ecx
mov eax, dword [esi + 0xb8]
mov edx, dword [esi + 0xb4]
push eax
mov byte [esp + 0x38], 0xc
call edx
mov eax, dword [esi + 0xb0]
push eax
mov eax, dword [esi + 0xac]
mov byte [esp + 0x3c], 0xb
call eax
mov eax, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
mov byte [esp + 0x3c], 0xa
push eax
call ecx
mov eax, dword [esi + 0xa0]
mov edx, dword [esi + 0x9c]
push eax
mov byte [esp + 0x44], 9
call edx
mov eax, dword [esi + 0x98]
push eax
mov eax, dword [esi + 0x94]
mov byte [esp + 0x48], 8
call eax
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0x8c]
push eax
mov byte [esp + 0x4c], 7
call ecx
mov eax, dword [esi + 0x88]
mov edx, dword [esi + 0x84]
push eax
mov byte [esp + 0x50], 6
call edx
lea edi, [esi + 0x6c]
add esp, 0x34
mov ecx, edi
call fcn.0058590f
mov eax, dword [edi + 0xc]
xor ebp, ebp
cmp eax, ebp
je 0x6cb800
push eax
call fcn.00776c58
add esp, 4
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
mov edi, dword [edi]
push edi
call fcn.00776c58
mov eax, dword [esi + 0x68]
push eax
mov eax, dword [esi + 0x64]
mov byte [esp + 0x24], 4
call eax
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x5c]
push eax
mov byte [esp + 0x28], 3
call ecx
mov edx, dword [esi + 0x58]
mov eax, dword [esi + 0x54]
push edx
mov byte [esp + 0x2c], 2
call eax
lea edi, [esi + 0x3c]
add esp, 0x10
mov ecx, edi
call fcn.0058590f
mov eax, dword [edi + 0xc]
cmp eax, ebp
je 0x6cb858
push eax
call fcn.00776c58
add esp, 4
mov ecx, dword [edi]
push ecx
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
call fcn.00776c58
add esp, 4
cmp dword [esi + 0x34], 8
jb 0x6cb87e
mov edx, dword [esi + 0x20]
push edx
call fcn.00776c58
add esp, 4
xor eax, eax
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ebp
lea ecx, [esi + 4]
mov word [esi + 0x20], ax
call fcn.00580d5f
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x6cd09f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b73b3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
mov dword [esi], 0x104b7cf4
call fcn.00580a1f
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ebx
mov word [esi + 0x20], ax
mov dword [esp + 0x18], ebx
mov byte [esi + 0x38], bl
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 1
call fcn.0057fe9f
mov dword [esi + 0x54], 0x10259a00
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], 0x10259a00
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], 0x10259a00
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 5
call fcn.0057fe9f
mov dword [esi + 0x84], 0x10259a00
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], 0x10259a00
mov dword [esi + 0x90], ebx
lea ecx, [esi + 0x94]
mov byte [esp + 0x18], 8
call fcn.006ba8bf
mov dword [esi + 0x9c], 0x10259a00
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], 0x10259a00
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], 0x10259a00
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], 0x10259a00
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], 0x10259a00
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], 0x10259a00
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], 0x10259a00
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], 0x10259a00
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], 0x10259a00
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], 0x10259a00
mov dword [esi + 0xe8], ebx
lea ecx, [esi + 0xf0]
mov byte [esp + 0x18], 0x13
mov dword [esi + 0xec], 0x10259a00
call fcn.0057fe9f
mov dword [esi + 0x108], 0x10259a00
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], 0x10259a00
mov dword [esi + 0x114], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x6d9d9f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103ae5dc
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x104b9928
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x18], 3
call eax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
push eax
mov byte [esp + 0x1c], 2
call ecx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push eax
mov byte [esp + 0x20], 1
call edx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push eax
mov byte [esp + 0x24], 0
call ecx
add esp, 0x10
cmp dword [esi + 0x1c], 8
jb 0x6d9e1d
mov edx, dword [esi + 8]
push edx
call fcn.00776c58
add esp, 4
xor eax, eax
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], ax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x6d9eaf
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b79c6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x104b9844
xor ebx, ebx
lea eax, [esi + 4]
lea ecx, [esi + 0xc]
lea edi, [esi + 0xe]
mov dword [esi + 0x10], 0x10259a00
mov dword [esi + 0x14], ebx
mov dword [esp + 0x28], ebx
mov dword [esi + 0x18], 0x10259a00
mov dword [esi + 0x1c], ebx
mov ebp, dword [esp + 0x30]
mov dword [eax], ebx
mov byte [eax + 4], bl
mov byte [ecx], bl
mov byte [ecx + 1], bl
mov byte [edi], bl
mov byte [edi + 1], bl
mov edx, dword [ebp + 8]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x18]
mov byte [esp + 0x28], 1
cmp eax, edx
je 0x6d9f31
mov edx, dword [ebp + 4]
mov dword [eax], edx
add eax, 4
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x6d9f42
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
mov dx, word [ebp + 0xc]
lea eax, [esp + 0x30]
cmp ecx, eax
je 0x6d9f50
mov byte [ecx], dl
lea eax, [ecx + 1]
lea ecx, [esp + 0x31]
cmp eax, ecx
je 0x6d9f5d
mov byte [eax], dh
mov cx, word [ebp + 0xe]
lea edx, [esp + 0x30]
cmp edi, edx
je 0x6d9f6b
mov byte [edi], cl
lea eax, [edi + 1]
lea edx, [esp + 0x31]
cmp eax, edx
je 0x6d9f78
mov byte [eax], ch
cmp dword [ebp + 0x14], ebx
je 0x6d9f88
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x6d9f8a
xor eax, eax
lea ecx, [esi + 0x14]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x6d9f9b
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
cmp dword [ebp + 0x1c], ebx
je 0x6d9fb4
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x6d9fb6
xor eax, eax
lea ecx, [esi + 0x1c]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x6d9fc7
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x6db11f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103ae421
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x104b9868
xor edx, edx
lea eax, [esi + 4]
mov dword [eax], edx
mov byte [eax + 4], dl
lea ecx, [esi + 0xc]
mov byte [ecx], dl
mov byte [ecx + 1], dl
mov dword [esi + 0x10], 0x10259a00
mov dword [esi + 0x14], edx
mov dword [esp + 0x28], edx
mov dword [esi + 0x18], 0x10259a00
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], 0x10259a00
mov dword [esi + 0x24], edx
mov edi, dword [esp + 0x30]
mov ebp, dword [edi + 4]
mov edx, dword [edi + 8]
lea ebx, [esp + 0x18]
mov byte [esp + 0x28], 2
cmp eax, ebx
je 0x6db19f
mov dword [eax], ebp
add eax, 4
lea ebx, [esp + 0x1c]
cmp eax, ebx
je 0x6db1ac
mov byte [eax], dl
mov dx, word [edi + 0xc]
lea eax, [esp + 0x30]
cmp ecx, eax
je 0x6db1ba
mov byte [ecx], dl
lea eax, [ecx + 1]
lea ecx, [esp + 0x31]
cmp eax, ecx
je 0x6db1c7
mov byte [eax], dh
cmp dword [edi + 0x14], 0
je 0x6db1d8
mov ecx, dword [edi + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
jmp 0x6db1da
xor eax, eax
lea ecx, [esi + 0x14]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x6db1eb
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
cmp dword [edi + 0x1c], 0
je 0x6db205
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x6db207
xor eax, eax
lea ecx, [esi + 0x1c]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x6db218
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
cmp dword [edi + 0x24], 0
je 0x6db232
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x6db234
xor eax, eax
lea ecx, [esi + 0x24]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x6db245
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x6e673f
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x103b8006
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x104b9904
xor eax, eax
lea ecx, [esi + 0xc]
lea edx, [esi + 4]
mov dword [edx], eax
mov byte [edx + 4], al
mov ebx, 0xf
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], eax
mov byte [ecx + 4], al
mov byte [ecx + 0x1c], al
lea edi, [esi + 0x34]
lea ebp, [esi + 0x2c]
mov dword [ebp], eax
mov byte [ebp + 4], al
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], eax
mov byte [edi + 4], al
mov dword [esp + 0x28], eax
mov byte [edi + 0x1c], al
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x28], 1
cmp edx, eax
je 0x6e67c9
mov eax, dword [ebx + 4]
mov dword [edx], eax
lea eax, [edx + 4]
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x6e67da
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
lea eax, [ebx + 0xc]
push eax
call fcn.00583c0f
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x30]
lea edx, [esp + 0x18]
cmp ebp, edx
je 0x6e67f4
mov dword [ebp], eax
lea eax, [ebp + 4]
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x6e6801
mov byte [eax], cl
add ebx, 0x34
push ebx
mov ecx, edi
call fcn.00583c0f
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x6e6c9f
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x104b815c
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10594d28
lea eax, [edi + 8]
push eax
push 0x104762e8
mov ecx, esi
call fcn.0057f29f
push 0x10594d28
add edi, 0x18
push edi
push 0x104762e4
mov ecx, esi
call fcn.0057f29f
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x6e82af
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x104b815c
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x105973a0
lea eax, [edi + 4]
push eax
push 0x10476548
mov ecx, esi
call fcn.0057eccf
push 0x105973a0
add edi, 0xc
push edi
push 0x10476154
mov ecx, esi
call fcn.0057eccf
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x6e8c5f
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x104b815c
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10599dd0
lea eax, [edi + 8]
push eax
push 0x1046aee0
mov ecx, esi
call fcn.0057f6af
push 0x10599dd0
lea ecx, [edi + 0x18]
push ecx
push 0x10476098
mov ecx, esi
call fcn.0057f6af
push 0x105987dc
add edi, 0x28
push edi
push 0x104760c4
mov ecx, esi
call fcn.0057ed9f
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x6e9abf
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x104b815c
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10599154
lea eax, [edi + 8]
push eax
push 0x1047a70c
mov ecx, esi
call fcn.0057f6af
push 0x105960a4
add edi, 0x18
push edi
push 0x1047a704
mov ecx, esi
call fcn.0057ea4f
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x6ea57f
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x104b815c
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10599154
lea eax, [edi + 8]
push eax
push 0x1047a6e4
mov ecx, esi
call fcn.0057f6af
push 0x10599154
lea ecx, [edi + 0x18]
push ecx
push 0x1047a6dc
mov ecx, esi
call fcn.0057f6af
push 0x10598c40
lea edx, [edi + 0x28]
push edx
push 0x104760b0
mov ecx, esi
call fcn.0057f0ff
mov ecx, dword [edi + 0x34]
push esi
call fcn.006e2f8f
mov edi, eax
test edi, edi
je 0x6ea654
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x6ebaef
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x104b815c
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x105951c4
lea eax, [edi + 4]
push eax
push 0x10476134
mov ecx, esi
call fcn.0057f16f
push 0x10595124
lea ecx, [edi + 0xc]
push ecx
push 0x1047612c
mov ecx, esi
call fcn.0057ea4f
push 0x10595124
lea edx, [edi + 0xe]
push edx
push 0x10476124
mov ecx, esi
call fcn.0057ea4f
push esi
mov ecx, edi
call fcn.006e756f
mov edi, eax
test edi, edi
je 0x6ebbc3
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x6f324f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b850d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x104bb9f4
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x18], 6
call eax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
push eax
mov byte [esp + 0x1c], 5
call ecx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push eax
mov byte [esp + 0x20], 4
call edx
mov eax, dword [esi + 0x28]
push eax
mov eax, dword [esi + 0x24]
mov byte [esp + 0x24], 3
call eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push eax
mov byte [esp + 0x28], 2
call ecx
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push eax
mov byte [esp + 0x2c], 1
call edx
mov eax, dword [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
mov byte [esp + 0x30], 0
call eax
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
mov dword [esp + 0x34], 0xffffffff
call edx
add esp, 0x20
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret