joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e54e410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e630480
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
mov byte [esp + 0x10], 1
call fcn.5e529ae0
mov ebx, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov edx, dword [ebx]
push ecx
push 0x5e685074
push eax
mov ecx, ebx
call dword [edx + 4]
push 0x48
call fcn.5e529af0
push eax
mov ecx, ebx
call fcn.5e52e5c0
mov dl, byte [esp + 0x10]
test dl, dl
mov ecx, 0x5e656bec
mov esi, 0x5e659b54
cmove esi, ecx
xor ecx, ecx
test dl, dl
cmovne ecx, eax
mov dword [esp + 0x1c], ecx
lea ecx, [edi + 0x44]
mov dword [esp + 0x18], 6
mov dword [esp + 0x14], 0x5e6565c8
call fcn.5e522d50
push 0
push esi
lea ecx, [esp + 0x5c]
mov dword [esp + 0x28], eax
call fcn.5e51edd0
mov ebx, eax
push 0
push esi
lea ecx, [esp + 0x44]
mov dword [esp + 0x80], 0
call fcn.5e51edd0
mov edi, eax
push ecx
lea eax, [esp + 0x18]
push eax
mov edx, str.EncodingLookupArray
lea ecx, [esp + 0x38]
mov byte [esp + 0x80], 1
call fcn.5e53dab0
add esp, 8
mov byte [esp + 0x78], 2
movzx ecx, byte [eax + 8]
push ecx
push ecx
push str.PaddingByte
mov ecx, eax
call fcn.5e54e5d0
mov esi, eax
lea eax, [esp + 0x18]
push 1
push eax
call fcn.5e51fa00
push eax
push ebx
call fcn.5e51f9d0
push eax
push edi
call fcn.5e51f9c0
push eax
lea eax, [esp + 0x38]
push eax
call fcn.5e51f9f0
push eax
mov ecx, esi
call fcn.5e527230
mov ecx, eax
call fcn.5e5272f0
mov ecx, eax
call fcn.5e5272f0
mov ecx, eax
call fcn.5e5286c0
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.5e51ef60
mov eax, dword [ebp + 8]
mov dword [esp + 0x24], vtable.CryptoPP::CombinedNameValuePairs.0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x78], 3
mov eax, dword [ecx]
push 0xffffffffffffffff
lea edx, [esp + 0x28]
push edx
call dword [eax + 0x28]
lea ecx, [esp + 0x24]
mov byte [esp + 0x78], 2
call fcn.5e51de30
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], 1
call fcn.5e51f710
lea ecx, [esp + 0x3c]
mov byte [esp + 0x78], 0
call fcn.5e51f6f0
lea ecx, [esp + 0x54]
mov dword [esp + 0x78], 0xffffffff
call fcn.5e51f6f0
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e552bd0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
xor eax, eax
push edi
movzx edx, byte [eax + 0x5e6569d8]
mov edi, edx
shr edi, 7
mov esi, edi
imul edi, edi, 0x11b
imul esi, esi, 0x1b000000
mov ecx, edx
shl ecx, 0x19
xor esi, ecx
mov ecx, edx
shl ecx, 8
or ecx, edx
shl ecx, 8
or esi, ecx
lea ecx, [edx + edx]
xor edi, ecx
xor edi, edx
xor ecx, ecx
or edi, esi
or ecx, esi
mov dword [eax*8 + 0x5e689710], ecx
mov dword [eax*8 + 0x5e689714], edi
inc eax
cmp eax, 0x100
jl 0x5e552bd4
xorps xmm0, xmm0
pop edi
movlpd qword [0x5e689f18], xmm0
movlpd qword [0x5e689f10], xmm0
mov byte [0x5e689705], 1
pop esi
ret

Function at 0x5e552c50
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor edx, edx
push esi
mov dword [esp + 0x18], edx
push edi
lea ecx, [ecx]
movzx edi, byte [edx + 0x5e656ad8]
mov eax, edi
shr eax, 5
mov edx, eax
mov ebx, eax
and eax, 1
mov dword [esp + 0x14], eax
and edx, 4
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], edi
lea ecx, [edi + edi]
xor ecx, edi
mov edx, edi
lea ebp, [ecx + ecx]
xor ebp, dword [esp + 0x10]
shr edi, 7
mov eax, edi
imul edi, edi, 0x11b
imul eax, eax, 0x1b000000
shl ebp, 0x19
xor ebp, eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0x1b000000
xor ebp, eax
and ebx, 2
mov eax, ebx
imul eax, eax, 0x1b000000
xor ebp, eax
shr edx, 6
mov esi, edx
and edx, 1
mov eax, edx
imul edx, edx, 0x11b00
imul eax, eax, 0x1b000000
xor ebp, eax
and esi, 2
mov eax, esi
imul esi, esi, 0x11b00
imul eax, eax, 0x1b000000
xor ebp, eax
mov eax, dword [esp + 0x18]
imul eax, eax, 0x1b000000
xor ebp, eax
mov eax, dword [esp + 0x14]
shl ecx, 2
imul eax, eax, 0x11b00
xor ecx, dword [esp + 0x10]
shl ecx, 8
xor ecx, eax
mov eax, ebx
imul eax, eax, 0x11b00
xor ecx, eax
xor ecx, edx
xor ecx, esi
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, esi
imul eax, eax, 0x11b00
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*8]
xor ecx, eax
mov eax, edx
imul edx, edx, 0x11b
imul eax, eax, 0x11b0000
shl ecx, 0x10
xor ecx, eax
mov eax, ebx
imul eax, eax, 0x11b0000
xor ecx, eax
mov eax, esi
imul eax, eax, 0x11b0000
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*4]
xor ecx, eax
add ecx, ecx
xor ecx, edi
xor ecx, edx
imul ebx, ebx, 0x11b
imul esi, esi, 0x11b
xor ecx, ebx
mov edx, eax
xor ecx, esi
xor ecx, edx
or edx, ebp
xor eax, eax
or eax, edx
mov edx, dword [esp + 0x1c]
or ecx, ebp
mov dword [edx*8 + 0x5e68a150], eax
mov dword [edx*8 + 0x5e68a154], ecx
inc edx
mov dword [esp + 0x1c], edx
cmp edx, 0x100
jl 0x5e552c60
pop edi
pop esi
pop ebp
mov byte [0x5e689704], 1
pop ebx
add esp, 0x10
ret
Function at 0x5e5544b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
movdqa xmm0, xmmword [eax]
push edi
mov edi, dword [ebp + 0xc]
lea edx, [esi - 1]
pxor xmm0, xmmword [edi]
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x5e5544fd
add edx, 0xfffffffe
shr edx, 1
lea ecx, [edi + 0x10]
inc edx
mov edi, edi
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmmword [ecx]
movdqa xmmword [eax], xmm0
aesenc xmm0, xmmword [ecx + 0x10]
movdqa xmmword [eax], xmm0
lea ecx, [ecx + 0x20]
dec edx
jne 0x5e5544e0
movdqa xmm0, xmmword [eax]
add esi, esi
aesenc xmm0, xmmword [edi + esi*8 - 0x10]
movdqa xmmword [eax], xmm0
aesenclast xmm0, xmmword [edi + esi*8]
pop edi
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5e554520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
movdqa xmm0, xmmword [ecx]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
pxor xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
sub esp, 8
pxor xmm0, xmm1
movdqa xmmword [edx], xmm0
push esi
mov esi, dword [ebp + 0x10]
push edi
movdqa xmm0, xmmword [esi]
mov edi, dword [ebp + 0x1c]
pxor xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edi, 1
jbe 0x5e5545d4
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
add edi, 0x10
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
jmp 0x5e554590
dec dword [esp + 0xc]
movdqa xmm1, xmmword [edi]
movdqa xmm0, xmmword [ecx]
aesenc xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
aesenc xmm0, xmm1
movdqa xmmword [edx], xmm0
movdqa xmm0, xmmword [esi]
aesenc xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
lea edi, [edi + 0x10]
jne 0x5e554590
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
movdqa xmm0, xmmword [ecx]
add edi, edi
movdqa xmm1, xmmword [eax + edi*8]
mov eax, dword [ebp + 0x14]
aesenclast xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
aesenclast xmm0, xmm1
movdqa xmmword [edx], xmm0
movdqa xmm0, xmmword [esi]
aesenclast xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
pop edi
aesenclast xmm0, xmm1
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e559200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e630d40
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5e682c80]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x2c], ebx
cmp byte [ebp + 0x14], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], eax
je 0x5e559357
mov edi, dword [edi]
mov ecx, dword [esp + 0x20]
mov ebx, dword [ebx + 0x14]
mov ecx, dword [ecx + 4]
mov eax, edi
or eax, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], ecx
je 0x5e5592d7
lea ebx, [ebx]
test ebx, ebx
je 0x5e5592d7
mov esi, dword [ebx + 0x14]
sub esi, dword [ebx + 0x10]
test ecx, ecx
ja 0x5e559296
jb 0x5e559294
cmp edi, esi
jae 0x5e559296
mov esi, edi
lea ecx, [ebx + 4]
call fcn.5e522910
add eax, dword [ebx + 0x10]
mov ecx, dword [esp + 0x1c]
push 1
mov edx, dword [ecx]
push 0
push esi
push eax
push dword [esp + 0x28]
call dword [edx + 0x8c]
add dword [ebx + 0x10], esi
mov ecx, dword [esp + 0x14]
mov ebx, dword [ebx]
sub edi, esi
sbb ecx, 0
mov eax, edi
or eax, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], ecx
jne 0x5e559280
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
call fcn.5e558f50
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 0x20]
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
cmp ecx, esi
ja 0x5e559303
jb 0x5e5592fd
cmp eax, edi
jae 0x5e559303
lea eax, [esp + 0x2c]
jmp 0x5e559307
lea eax, [esp + 0x24]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x5e55934a
cmp byte [ebx + 0x24], 0
mov edx, dword [esp + 0x1c]
push 1
mov eax, dword [edx]
push 0
push ecx
push dword [ebx + 0x1c]
mov ecx, edx
push dword [esp + 0x28]
je 0x5e559333
call dword [eax + 0x8c]
jmp 0x5e559339
call dword [eax + 0x88]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
add dword [ebx + 0x1c], eax
sub dword [ebx + 0x20], eax
sub edi, eax
sbb esi, 0
mov eax, dword [esp + 0x20]
sub dword [eax], edi
sbb dword [eax + 4], esi
xor eax, eax
jmp 0x5e5593c9
lea ecx, [esp + 0x34]
call fcn.5e51e7c0
mov dword [esp + 0x78], 0
push dword [0x5e68a0b0]
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], vtable.CryptoPP::ByteQueue::Walker.1.0
mov dword [esp + 0x3c], vtable.CryptoPP::ByteQueue::Walker.0
mov dword [esp + 0x44], ebx
call dword [0x5e659528]
push 0
push dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
push edi
push esi
mov dword [esp + 0x88], 1
call fcn.5e5597c0
push dword [edi + 4]
mov edx, dword [ebx]
push dword [edi]
mov ecx, ebx
mov esi, eax
call dword [edx + 0x54]
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], 0xffffffff
call fcn.5e51de30
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.5e5fd9c7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5e563790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e625d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.5e52cad0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x38], edx
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x3c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x30], edx
mov eax, dword [ecx + 0x3c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.5e5a7420
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x44], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x40]
add ecx, 4
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
add eax, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
add edx, 4
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x38]
sub ecx, 1
mov edx, dword [eax + 0x3c]
sbb edx, 0
mov eax, dword [ebp - 0x10]
add ecx, dword [eax + 0x40]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5e5ba350
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e629773
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.5e5161f0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x48], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5e5ba420
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e629790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov eax, dword [0x5e656bd8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.5e515bf0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 0x30
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.5e5161f0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e5ba510
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e6297ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.5e5161f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x48], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5e5bdea0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e629a63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.5e5161f0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5e5be100
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e629aba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
call fcn.5e5161f0
mov eax, dword [0x5e656bd8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.5e515bf0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 0x18
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov edx, dword [0x5e656bd8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.5e515bf0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov ecx, dword [0x5e656bd8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.5e515bf0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5e5be200
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e629ad7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
call fcn.5e5161f0
mov eax, dword [0x5e656bd8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.5e515bf0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 0x18
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov edx, dword [0x5e656bd8]
push edx
push 0
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x14]
call fcn.5e515bf0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov ecx, dword [0x5e656bd8]
push ecx
push 0
mov edx, dword [ebp + 8]
add edx, 0x30
push edx
mov ecx, dword [ebp - 0x18]
call fcn.5e515bf0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e5c20c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e629f53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.5e5bb2b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.Poco::XML::ProcessingInstruction.0
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov edx, dword [0x5e656bd8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.5e515bf0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov ecx, dword [0x5e656bd8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.5e515bf0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5e5c21a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e629f70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.5e5bb310
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx], vtable.Poco::XML::ProcessingInstruction.0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.5e5161f0
mov eax, dword [0x5e656bd8]
push eax
push 0
mov ecx, dword [ebp + 0xc]
add ecx, 0x18
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.5e515bf0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 0x30
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.5e5161f0
mov edx, dword [0x5e656bd8]
push edx
push 0
mov eax, dword [ebp + 0xc]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x18]
call fcn.5e515bf0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8