joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d5dc
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
sahf
fld dword [eax]
xor dl, bh
push es
call 0x31756a6c
mov fs, word [ebx]
dec esp
ja 0x41d5e2
jmp 0x41d5f7
imul byte [eax + ecx + 0x1037d4b8]
pop ss
jae 0xe963da82
inc edx
int1
cmpsb byte [esi], byte es:[edi]
adc eax, 0x3bc8ca0
adc byte [ebx], bl
add eax, eax
pop ebp
mov ebx, edx
xchg edi, eax
xor byte [eax], bh
cmp ecx, dword [esp + edi*8 + 0x14]
aaa
jecxz 0x41d5ea
insd dword es:[edi], dx
add al, 0xf0
adc esi, dword [esi]
sub byte [eax - 0x2fcb0855], 0x1f
pop ds
jmp 0x41d678
loop 0x41d6ca
lea ax, [eax]
dec byte [0x37f6c569]
aaa
test al, 0x15
invalid
mov esp, 0x15b8124e
mov bh, 0xd4
jns 0x41d629
test ch, al
xor eax, 0xb8d2aab4
xchg dword [edi + ebp + 0x38c435e2], ebp
fiadd dword [ecx]
outsd dx, dword [esi]
push eax
sub ebp, esi
sar eax, 1
clc
jne 0x41d696
and eax, 0x43ecd7f3
jae 0x41d661
and al, 0x2b
add al, byte [eax]
mov esp, 0xdc78ad61
inc edx
inc esi
pop ecx
adc dword [eax + 0x59256db], eax
or byte [ecx + 0x6e023441], ah
sub ah, bl
cld
lodsb al, byte [esi]
or byte [eax - 0x12], al
jp 0x41d6e5
loopne 0x41d6e2
pop esi
jg 0x41d657
ffreep st(4)
in al, dx
or byte [eax], bh
popfd
or byte [edi + 0x17], dl
inc edx
sbb byte [ecx], ah
inc edx
mov cl, 0x1a
inc esi
shr byte [ebp - 0x5fdcbffd], 0xe6
xor edi, dword [edi - 0x6c49221b]
in eax, 0xdd
mov dh, 0x93
xchg ebx, eax
bswap ebx
sub eax, 0x1a7ab6ef
invalid
Function at 0x401280
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40129e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x401360
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x401382
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x401470
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40149a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x4015e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40163f
Function at 0x402fc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4034e0
test edx, edx
je 0x4034e0
call fcn.00402fd7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x403520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00402fc0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x403591
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x403556
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x406cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406cc9

Function at 0x414cac
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x414cfa
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x414cd4
cmp edx, 1
je 0x414d1b
cmp edx, 2
je 0x414d12
cmp edx, 3
jne 0x414d26
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x421590
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
lea ecx, [esi + 0x50]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x431fb0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x29]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.0042ee1a
add esp, 0x10
mov dword [esi + 4], esp
lea eax, [esi + 0x18]
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov byte [eax + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d8c0
add esp, 4
lea eax, [esi + 0x18]
mov dword [edi], eax
mov dword [edi + 4], 0xd
lea eax, [esi + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043513e
add esp, 0x1c
mov esp, dword [esi + 4]
add eax, esi
add eax, 0x18
mov dword [esi + 4], eax
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.0042230a
add esp, 0xc
mov dword [esi + 0x14], eax
lea edi, [esi + 0x30]
mov dword [edi + 0x13], ebx
mov dword [edi + 0xf], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea eax, [esi + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0xc]
mov dword [eax], ebx
lea ebx, [esi + 8]
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0041991a
lea eax, [esi + 0x50]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
push edi
push dword [esi + 4]
push dword [esi + 0x14]
lea eax, [esi + 0x18]
push eax
call fcn.00423500
add esp, 0x1c
mov ebx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
test eax, eax
jne 0x4216c6
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x58], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x58], 0xffffffff
movsx edx, dl
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00414229
add esp, 0x1c
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x421960
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
lea ecx, [esi + 0x50]
mov dword [ecx - 4], esp
xor ebx, ebx
dec ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 4], 0x431fd0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x29]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edi + 4]
push edx
push ecx
push eax
call fcn.0042ee1a
add esp, 0x10
mov dword [esi + 4], esp
lea eax, [esi + 0x18]
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov byte [eax + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d8c0
add esp, 4
lea eax, [esi + 0x18]
mov dword [edi], eax
mov dword [edi + 4], 0xd
lea eax, [esi + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043513e
add esp, 0x1c
mov esp, dword [esi + 4]
add eax, esi
add eax, 0x18
mov dword [esi + 4], eax
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.0042230a
add esp, 0xc
mov dword [esi + 0x14], eax
lea edi, [esi + 0x30]
mov dword [edi + 0x13], ebx
mov dword [edi + 0xf], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea eax, [esi + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0xc]
mov dword [eax], ebx
lea ebx, [esi + 8]
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0041991a
lea eax, [esi + 0x50]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
push edi
push dword [esi + 4]
push dword [esi + 0x14]
lea eax, [esi + 0x18]
push eax
call fcn.00423500
add esp, 0x1c
mov ebx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
test eax, eax
jne 0x421a95
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x58], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x58], 0xffffffff
movsx edx, dl
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00414229
add esp, 0x1c
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x422170
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0xc], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x432320
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea ebx, [esi + 0x50]
mov dword [ebx + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
push eax
sub esp, 0x18
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d8c0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x14
mov dword [edi + 0x14], 0x4d01a9
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043513e
add esp, 0x1c
mov esp, dword [esi + 0xc]
mov dword [esi + 0xc], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
push eax
push ebx
call fcn.0042230a
add esp, 0xc
mov dword [esi + 0x18], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 0x10]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.0041991a
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
mov ecx, edi
push 0x4e8450
call fcn.0042cf88
mov ebx, eax
mov edi, dword [esi + 0x10]
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x422269
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x78], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [esi + 0x14]
mov eax, dword [ebx]
mov edi, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
lea eax, [esi + 0x20]
mov ecx, ebx
push eax
mov ebx, dword [esi + 0x1c]
push ebx
lea eax, [esi + 0x50]
push eax
call edi
mov ecx, dword [esi + 0x18]
mov eax, ecx
lea edx, [esi + 0x50]
sub eax, edx
cmp ecx, ebx
mov ecx, dword [esi + 0xc]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00414229
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x422580
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x432000
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.0042ee1a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d8c0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043513e
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.0042230a
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041991a
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.00423d70
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4226bb
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00423380
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x422760
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x432010
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.0042ee1a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d8c0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043513e
add esp, 0x20
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.0042230a
add esp, 0xc
mov dword [esi + 8], eax
lea ebx, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x4a], xmm0
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041991a
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.00423d70
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4228be
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00423380
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x422970
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x432020
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.0042ee1a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d8c0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043513e
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.0042230a
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041991a
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.00423d70
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x422aaa
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00423380
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x422b50
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x432030
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.0042ee1a
add esp, 0x10
mov dword [esi + 8], esp
lea eax, [esi + 0x20]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [eax], xmm0
mov ebx, eax
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.0041d8c0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043513e
add esp, 0x20
mov esp, dword [esi + 8]
lea ebx, [esi + eax]
add ebx, 0x20
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0x20]
push eax
call fcn.0042230a
add esp, 0xc
mov dword [esi + 8], eax
lea edi, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x4a], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041991a
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push edi
push ebx
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.00423d70
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x422cb2
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00423380
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c