joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ef6
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, edx
and edx, 0x3fff
mov eax, esi
and eax, 0xf0000000
cmove edx, esi
pop esi
jmp fcn.00407e68

Function at 0x4089a9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x56abde
call fcn.00566e38
sub esp, 0xc
push esi
push edi
mov edi, ecx
call fcn.00409f27
mov esi, eax
cmp esi, 1
je 0x4089d6
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408a1b
test esi, esi
je 0x408a18
lea ecx, [ebp - 0x18]
call fcn.004025e6
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
cmp esi, 1
mov ecx, edi
setne al
movzx eax, al
push eax
call fcn.00409ac9
push dword [ebp - 0x18]
test al, al
je 0x408a12
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push dword [ebp - 0x18]
mov esi, eax
call fcn.00566e0e
pop ecx
mov eax, esi
jmp 0x408a1b
call fcn.00566e0e
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x408b0d
Capabilities:
Get disk information

Disassembly:
mov eax, 0x56ad37
call fcn.00566e38
sub esp, 0x24
push ebx
mov eax, ecx
push edi
mov dword [ebp - 0x14], eax
call fcn.00402e2c
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x408b40
xor al, al
jmp 0x408bde
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00407f0f
mov esi, dword [ebp - 0x20]
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x408bd4
cmp edi, dword [ebp - 0x1c]
ja 0x408bd4
lea ecx, [ebp - 0x30]
call fcn.004025e6
mov byte [ebp - 4], 1
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov eax, ebx
test edi, edi
je 0x408bc6
push 2
pop ecx
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0x18], eax
cmp word [ecx + esi - 2], bx
jne 0x408bb9
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.004027d6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call fcn.0040393c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push eax
call fcn.00402b2f
mov ecx, dword [ebp - 0x10]
mov edx, ecx
mov eax, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x10], ecx
cmp eax, edi
jb 0x408b80
mov edx, dword [ebp - 0x1c]
push dword [ebp - 0x30]
cmp edx, edi
sete bl
call fcn.00566e0e
pop ecx
push esi
call fcn.00566e0e
pop ecx
mov al, bl
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4091b1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 5], 0
je 0x4091d3
cmp byte [ecx + 6], 0
je 0x4091d3
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov al, 1
jmp 0x40920e
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4091f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4091f9
xor al, al
jmp 0x40920d
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x40b68c
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x30]
mov esi, ecx
push eax
lea eax, [esp + 0x2c]
mov edi, edx
push eax
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [ebx], ecx
mov ecx, dword [esp + 0x34]
push eax
lea eax, [esp + 0x24]
mov dword [ebx + 4], edx
mov edx, dword [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
mov dword [ebp], ecx
push eax
push esi
mov dword [ebp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x40b6f7
xor al, al
jmp 0x40b73b
mov eax, dword [esp + 0x18]
mul dword [esp + 0x1c]
cmp dword [esp + 0x20], 0
mov esi, eax
mov dword [edi + 4], edx
mov dword [edi], esi
jne 0x40b739
mov eax, edx
mul dword [esp + 0x10]
mov ecx, eax
mov eax, esi
mul dword [esp + 0x10]
add ecx, edx
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov eax, dword [edi + 4]
mul dword [esp + 0x14]
mov ecx, eax
mov eax, dword [edi]
mul dword [esp + 0x14]
add ecx, edx
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x40baf5
Capabilities:
Get session user name
Manipulate user privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 0x28], 0x18
push eax
xor ebx, ebx
lea eax, [ebp - 0x28]
push 0xf0fff
push eax
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x40bbd2
push esi
push edi
push 0xb
pop ecx
push 0xd4
lea eax, [ebp - 0xfc]
mov esi, str.SeLockMemoryPrivilege
lea edi, [ebp - 0x128]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x128]
push eax
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [ebp - 8], 0x100
mov word [ebp - 0x10], ax
add esp, 0x10
add eax, 2
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40bbd0
lea ecx, [ebp - 0x32c]
call fcn.0040bbe5
mov edi, eax
test edi, edi
je 0x40bbd0
push 1
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaAddAccountRights
push edi
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
sete bl
pop edi
pop esi
cmp dword [ebp - 4], 0
je 0x40bbe0
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaClose
mov al, bl
pop ebx
leave
ret

Function at 0x40bbe5
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0x10
mov eax, ecx
xor edx, edx
lea ecx, [esp + 8]
mov dword [esp + 0xc], eax
push ecx
lea ecx, [esp + 4]
mov dword [esp + 8], edx
push ecx
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], edx
push ecx
push edx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x40bc8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40bc8a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebp
push esi
push edi
push dword [esp + 0x14]
push 8
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov ecx, dword [esp + 0x10]
mov ebp, eax
lea ecx, [ecx*2 + 2]
push ecx
push 8
call ebx
push eax
call esi
mov edi, eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push ebp
push dword [esp + 0x30]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push edi
push 0
mov esi, eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test esi, esi
pop edi
pop esi
cmovne eax, ebp
pop ebp
pop ebx
jmp 0x40bc8c
xor eax, eax
add esp, 0x10
ret
Function at 0x40bca4
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push ebp
push edi
push dword [esp + 0x14]
mov ebp, ecx
xor ebx, ebx
push 0x2002
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov edi, edx
call fcn.0040c968
test al, al
je 0x40bd03
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40bd02
push dword [esp + 0x18]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esp + 0x10]
push ebp
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40bd02
mov dword [esp + 0x10], ebx
mov bl, 1
pop esi
lea ecx, [esp + 0xc]
call fcn.0040c989
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 4

Function at 0x40ccc7
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
sub esp, 0x40
mov eax, 0x56af27
call fcn.00566e38
sub esp, 0x44
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp + 0x40], esi
call fcn.0040cca8
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x1c]
call fcn.004025b0
xor ebx, ebx
lea ecx, [ebp + 0x34]
inc ebx
push 0x22
mov dword [ebp - 4], ebx
call fcn.0040254d
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x40], ebx
push eax
lea ecx, [ebp + 0x34]
call fcn.00402a38
push 0x22
lea ecx, [ebp + 0x34]
call fcn.00402b9d
push 0x20
lea eax, [ebp + 0x34]
push eax
lea ecx, [ebp + 0x28]
call fcn.004023f0
mov dword [ebp + 0x40], 3
push dword [ebp + 0x50]
lea edx, [ebp + 0x28]
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x10]
call fcn.00402947
push dword [ebp + 0x28]
call fcn.00566e0e
push dword [ebp + 0x34]
call fcn.00566e0e
push dword [ebp + 0x1c]
call fcn.00566e0e
add esp, 0xc
mov dword [ebp - 0x50], 0x44
xor eax, eax
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x1e], ax
lea eax, [ebp]
mov dword [ebp - 0x48], esi
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x44], esi
push eax
push dword [ebp + 0x54]
mov dword [ebp - 0x24], esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0x1c], esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40cda1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40cdaf
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp]
mov dword [edi], eax
push dword [ebp + 0x10]
call fcn.00566e0e
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x44
leave
ret 0xc

Function at 0x40d284
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8

Function at 0x40d2b1
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8
Function at 0x40d2cb
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc

Function at 0x40e025
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov edx, SysReAllocString
push edi
lea ecx, [ebp - 0x10]
mov eax, dword [esi]
and dword [esi + 4], 0
mov byte [eax], 0
call fcn.00547410
cmp dword [ebp - 0x10], 0x80000004
jb 0x40e079
xor edi, edi
push ebx
lea edx, [edi - 0x7ffffffe]
lea ecx, [ebp - 0x10]
call fcn.00547410
xor ebx, ebx
mov edx, dword [ebp + ebx*4 - 0x10]
mov ecx, esi
call fcn.0040dd2f
inc ebx
cmp ebx, 4
jb 0x40e061
inc edi
cmp edi, 3
jb 0x40e051
pop ebx
mov ecx, esi
call fcn.00403f28
mov ecx, esi
call fcn.00403ece
cmp dword [esi + 4], 0
jne 0x40e0bf
xor edx, edx
lea ecx, [ebp - 0x10]
call fcn.00547410
xor edi, edi
inc edi
mov edx, edi
mov ecx, esi
shr edx, 1
xor edx, edi
mov edx, dword [ebp + edx*4 - 0x10]
call fcn.0040dd2f
inc edi
cmp edi, 4
jb 0x40e09a
mov ecx, esi
call fcn.00403f28
mov ecx, esi
call fcn.00403ece
pop edi
pop esi
leave
ret
Function at 0x4207ac
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 4]
xor edx, edx
mov ecx, dword [ecx]
inc edx
push ebx
push ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov edi, edx
mov dword [esp + 0x1c], edi
mov ebp, 0x159a55e5
mov dword [esp + 0x18], edx
mov ebx, 0x1f123bb5
test eax, eax
je 0x420967
movzx eax, bp
imul eax, eax, 0x9069
shr ebp, 0x10
add ebp, eax
movzx eax, bx
imul eax, eax, 0x4650
mov edx, ebp
shr ebx, 0x10
shl edx, 0x10
add ebx, eax
add edx, ebx
xor edx, dword [esp + 0x34]
mov eax, edx
shr edx, 1
test eax, 1
je 0x420971
cmp esi, 0x400
jb 0x420971
xor eax, eax
mov ecx, edx
and ecx, 3
shr edx, 2
inc eax
inc ecx
shl eax, cl
dec eax
and eax, edx
shr edx, cl
inc eax
mov dword [esp + 0x10], eax
mov eax, edx
shr edx, 3
test eax, 7
je 0x420914
xor eax, eax
mov ecx, edx
inc eax
shr edx, 2
and ecx, 3
inc ecx
shl eax, cl
dec eax
and eax, edx
shr edx, cl
add dword [esp + 0x10], eax
xor eax, eax
mov ecx, dword [esp + 0x18]
inc eax
shl eax, cl
cmp eax, esi
jae 0x42087d
xor eax, eax
inc ecx
inc eax
shl eax, cl
cmp eax, esi
jb 0x42086f
mov dword [esp + 0x18], ecx
mov edi, dword [esp + 0x30]
cmp edi, ecx
push 0x15
cmova edi, ecx
pop eax
cmp eax, edi
mov dword [esp + 0x28], edi
sbb eax, eax
and eax, 0x10
add eax, 0xf
mov dword [esp + 0x1c], eax
mov ecx, eax
movzx eax, bp
imul eax, eax, 0x9069
and ecx, edx
shr ebp, 0x10
add ecx, 6
add ebp, eax
movzx eax, bx
imul eax, eax, 0x4650
mov edx, ebp
shr ebx, 0x10
shl edx, 0x10
mov dword [esp + 0x24], ebp
add ebx, eax
mov eax, dword [esp + 0x1c]
add edx, ebx
xor edx, dword [esp + 0x34]
cmp ecx, edi
ja 0x42089b
xor edi, edi
inc edi
shl edi, cl
dec edi
and edi, edx
cmp edi, esi
jb 0x42090f
mov edi, dword [esp + 0x28]
mov ecx, ebp
movzx eax, cx
imul ebp, eax, 0x9069
movzx eax, bx
imul eax, eax, 0x4650
shr ebx, 0x10
shr ecx, 0x10
add ebp, ecx
add ebx, eax
mov eax, dword [esp + 0x1c]
mov edx, ebx
xor edx, dword [esp + 0x34]
jmp 0x42089b
inc edi
mov dword [esp + 0x1c], edi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
sub ecx, esi
cmp dword [esp + 0x10], ecx
cmovbe ecx, dword [esp + 0x10]
add eax, esi
and dword [esp + 0x24], 0
mov edx, eax
add esi, ecx
mov dword [esp + 0x28], eax
sub edx, edi
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x420959
mov esi, dword [esp + 0x24]
mov edi, eax
mov al, byte [edx]
mov byte [edi], al
inc edi
inc edx
inc esi
cmp esi, ecx
jb 0x420946
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
cmp esi, dword [esp + 0x20]
jb 0x4207e1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov byte [ecx + esi], dl
inc esi
jmp 0x42095d

Function at 0x420977
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 4]
mov edx, 0x1f123bb5
push edi
mov edi, dword [ecx]
xor ecx, ecx
test esi, esi
je 0x4209a5
movzx eax, dx
imul eax, eax, 0x4650
shr edx, 0x10
add edx, eax
mov al, dl
xor al, byte [esp + 0xc]
mov byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x420989
pop edi
pop esi
ret 4
Function at 0x422a75
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x422b8a
mov eax, dword [esp + 4]
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
sub edx, 1
jne 0x422a81
mov eax, ecx
ret 4

Function at 0x422b8f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x56be8e
call fcn.00566e38
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.004024ee
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.004024ee
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x18]
call fcn.004024ee
lea eax, [esi + 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x24]
call fcn.004024ee
lea eax, [esi + 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x30]
call fcn.004024ee
mov al, byte [esi + 0x3c]
lea ecx, [edi + 0x40]
mov byte [edi + 0x3c], al
lea eax, [esi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.004024ee
lea eax, [esi + 0x4c]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0x4c]
call fcn.004024ee
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x422c22
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x56be8e
call fcn.00566e38
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004025e6
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004025e6
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004025e6
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004025e6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004025e6
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
mov byte [esi + 0x3c], 0
call fcn.004025e6
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x422cdf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56bf1c
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x3c]
mov dword [esi], 0x57ac0c
mov dword [esi + 4], 0x57ac30
mov dword [esi + 8], 0x57ac44
mov dword [esi + 0xc], 0x57ac58
mov dword [esi + 0x10], 0x57ac68
mov dword [esi + 0x14], 0x57ac8c
mov dword [esi + 0x18], 0x57aca8
mov dword [esi + 0x1c], 0x57acb8
mov dword [esi + 0x20], 0x57acc8
mov dword [esi + 0x2a], 0x1000000
mov byte [esi + 0x2e], bl
mov word [esi + 0x30], bx
mov word [esi + 0x38], bx
call fcn.004025e6
lea ecx, [esi + 0x48]
mov dword [ebp - 4], ebx
call fcn.004025e6
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004025e6
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x78], ebx
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 4
mov dword [esi + 0x94], ebx
mov word [esi + 0x98], bx
call fcn.004025e6
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 5
call fcn.004025e6
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 6
call fcn.004025e6
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 7
call fcn.004025e6
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 8
call fcn.004025e6
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 9
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x422e05
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56bf38
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
lea ecx, [esi + 0x18]
mov word [esi + 4], bx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00416f99
lea ecx, [esi + 0x30]
call fcn.004025e6
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x422f0d
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x56bf67
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.004025e6
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004025e6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov word [esi + 0x24], bx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4247bc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56c1af
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x38]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
call fcn.00422cb7
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.00419352
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x426cb7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56c4eb
call fcn.00566e38
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
call fcn.004025e6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00426c6e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret