joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419f80
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x52a1ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [esp + 0x10], esi
lea edi, [esi + 0xc]
mov dword [esi], 0x5455c8
mov byte [esi + 4], bl
mov dword [esp + 0x14], edi
lea eax, [esp + 0xf]
mov ecx, edi
push eax
mov dword [esp + 0x24], ebx
call fcn.0050e020
push 8
mov byte [esp + 0x24], 2
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], bl
lea ecx, [esi + 0x18]
mov dword [esp + 0x20], 3
call fcn.00405fe0
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esi + 0x24]
mov byte [esp + 0x28], 5
call fcn.00405eb0
mov dword [esi], 0x5457a0
mov dword [esi + 0x30], 0x42c80000
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edx, 0x3f800000
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], edx
lea eax, [esi + 0x44]
mov ecx, 6
mov edi, 0x5a
mov dword [eax], 0x28
mov dword [eax + 4], edi
mov dword [eax + 8], edx
add eax, 0xc
dec ecx
jne 0x41a031
mov ecx, dword [esp + 0x18]
mov dword [esi], 0x5457cc
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x41e820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52a9f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebp
push esi
mov esi, dword [esp + 0x64]
push edi
push esi
lea eax, [esp + 0x4c]
push 0x576868
push eax
call fcn.0040ee60
push 0x576864
lea ecx, [esp + 0x4c]
push eax
push ecx
mov dword [esp + 0x74], 0
call fcn.00406250
mov edi, dword [esp + 0x84]
lea edx, [esp + 0x48]
push edi
push eax
push edx
mov byte [esp + 0x80], 1
call fcn.00406250
mov ebp, dword [eax]
push esi
lea eax, [esp + 0x4c]
push 0x576854
push eax
mov byte [esp + 0x8c], 2
call fcn.0040ee60
push 0x576864
lea ecx, [esp + 0x4c]
push eax
push ecx
mov byte [esp + 0x98], 3
call fcn.00406250
push edi
lea edx, [esp + 0x4c]
push eax
push edx
mov byte [esp + 0xa4], 4
call fcn.00406250
add esp, 0x48
mov ecx, dword [esp + 0x64]
mov edi, dword [eax]
push 0x3f800000
push ebp
push 0x57684c
push fcn.0041e810
mov byte [esp + 0x6c], 5
call fcn.00420cf0
mov eax, dword [0x57f188]
push 0xffffffffffffffff
fstp dword [esp + 0x6c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
fld dword [esp + 0x68]
sub esp, 8
mov esi, eax
fstp qword [esp]
mov ebp, dword [esi]
push 0x57668c
call fcn.004c2ae0
add esp, 0xc
push eax
push edi
push esi
call dword [ebp + 0x1c]
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 4
call fcn.00418e50
lea ecx, [esp + 0x18]
mov byte [esp + 0x5c], 3
call fcn.00418e50
mov byte [esp + 0x5c], 2
lea ecx, [esp + 0x24]
call fcn.00418e50
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 1
call fcn.00418e50
lea ecx, [esp + 0x3c]
mov byte [esp + 0x5c], 0
call fcn.00418e50
lea ecx, [esp + 0x48]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00418e50
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x42dbe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x42dbeb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x42dcee
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x546628]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x546628]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x546628]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x546628]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x546628]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x546628]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x546628]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x546628]
xor eax, edx
inc ecx
dec edi
jne 0x42dc06
pop edi
test esi, esi
je 0x42dd10
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x546628]
xor eax, edx
inc ecx
dec esi
jne 0x42dcf2
pop esi
pop ebx
not eax
ret
Function at 0x42e310
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x52cf15
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 0xc]
mov dword [esp + 0x1c], esi
mov dword [esi], 0x5455c8
mov byte [esi + 4], bl
mov dword [esp + 0x14], edi
lea eax, [esp + 0x13]
mov ecx, edi
push eax
mov dword [esp + 0x100], ebx
call fcn.0050e020
push 8
mov byte [esp + 0x100], 2
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], bl
lea edi, [esi + 0x18]
mov dword [esp + 0xfc], 3
mov dword [esp + 0x14], edi
lea edx, [esp + 0x1b]
mov ecx, edi
push edx
mov byte [esp + 0x100], 4
call fcn.0050e020
push 8
mov byte [esp + 0x100], 6
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], bl
lea ebp, [esi + 0x24]
lea edx, [esp + 0x12]
push edx
mov ecx, ebp
mov byte [esp + 0x100], 8
mov dword [esp + 0x18], ebp
call fcn.0050e020
mov edi, 0x5765b0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x11]
repne scasb al, byte es:[edi]
mov al, byte [esp + 0x12]
push edx
not ecx
dec ecx
mov byte [esp + 0x100], 9
add ecx, 0x5765b0
mov byte [esp + 0x15], al
push ecx
push 0x5765b0
mov ecx, ebp
call fcn.004012f0
mov dword [esi], 0x5457a0
lea edi, [esi + 0x50]
mov dword [esp + 0xfc], 0xa
mov dword [esi + 0x48], ebx
mov dword [esp + 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push 0xd4
mov byte [esp + 0x100], 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov dword [edi + 4], eax
add eax, 0xd4
add esp, 4
mov dword [edi + 8], eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xfc], 0xe
call fcn.0042df00
mov ebp, dword [edi]
mov cl, byte [esp + 0x12]
lea edx, [esp + 0x11]
mov byte [esp + 0xfc], 0xf
push edx
push eax
push 1
push ebp
mov byte [esp + 0x21], cl
call fcn.00440e90
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [edi + 4], eax
mov byte [esp + 0xfc], 0xe
call fcn.0043e700
mov ecx, dword [esp + 0xf4]
mov eax, 0x3f800000
mov dword [esi + 0x30], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x34], eax
mov dword [esi], 0x546bb8
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 0x41f00000
mov dword [esi + 0x44], 0x64
mov word [esi + 0x4c], bx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xf0
ret
Function at 0x430530
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x52d504
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], esi
mov dword [esi], 0x5455c8
mov byte [esi + 4], bl
call fcn.00405fe0
lea ecx, [esi + 0x18]
mov dword [esp + 0x24], ebx
call fcn.00405fe0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push eax
push ecx
lea ecx, [esi + 0x24]
mov byte [esp + 0x2c], 2
call fcn.00405eb0
mov dword [esi], 0x5457a0
mov dword [esp + 0x24], 3
mov dword [esi + 0x30], 0x42c80000
lea edx, [esp + 0x13]
lea ecx, [esi + 0x34]
push edx
mov byte [esp + 0x28], 4
call fcn.0050e020
mov edx, 0x3f800000
lea eax, [esi + 0x44]
mov dword [esi + 0x40], edx
mov ecx, 6
mov edi, 0x5a
mov dword [eax], 0x28
mov dword [eax + 4], edi
mov dword [eax + 8], edx
add eax, 0xc
dec ecx
jne 0x4305c4
mov dword [esi], 0x5457cc
lea edi, [esi + 0x94]
mov dword [esp + 0x24], 5
mov dword [esi + 0x8c], ebx
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea eax, [esp + 0x2c]
push ebx
push eax
mov ecx, ebp
mov byte [esp + 0x2c], 6
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.005124c0
push 8
mov byte [esp + 0x28], 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
add esp, 4
mov byte [eax], bl
lea edi, [esi + 0xa0]
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea edx, [esp + 0x2c]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x2c], 0xa
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.005124c0
push 8
mov byte [esp + 0x28], 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
mov ecx, dword [esp + 0x1c]
mov byte [eax], bl
mov dword [esi], 0x54580c
mov byte [esi + 0x90], bl
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x433880
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x52da26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 0xc]
mov dword [esp + 0x14], esi
mov dword [esi], 0x5455c8
mov byte [esi + 4], bl
mov dword [esp + 0x18], edi
lea eax, [esp + 0x12]
mov ecx, edi
push eax
mov dword [esp + 0x28], ebx
call fcn.0050e020
push 8
mov byte [esp + 0x28], 2
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], bl
lea ecx, [esi + 0x18]
mov dword [esp + 0x24], 3
call fcn.00405fe0
lea ebp, [esi + 0x24]
lea edx, [esp + 0x13]
push edx
mov ecx, ebp
mov byte [esp + 0x28], 5
mov dword [esp + 0x1c], ebp
call fcn.0050e020
mov edi, 0x5765ac
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x24], 6
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x5765ac
push ecx
push 0x5765ac
mov ecx, ebp
call fcn.004067c0
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi], 0x546cfc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x433980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52da69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x546cfc
lea ebx, [edi + 0x30]
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], ebx
mov ebp, dword [ebx + 4]
mov eax, dword [ebx]
cmp eax, ebp
je 0x4339f2
push esi
lea esi, [eax + 4]
mov dword [esp + 0x18], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
mov byte [esp + 0x2c], 2
call fcn.004e6250
add esp, 8
mov ecx, esi
mov byte [esp + 0x24], 1
call fcn.00418e50
add esi, 0x10
lea edx, [esi - 4]
cmp edx, ebp
jne 0x4339c3
pop esi
mov ebx, dword [ebx]
test ebx, ebx
je 0x433a01
push ebx
call fcn.005265a0
add esp, 4
lea eax, [edi + 0x24]
mov dword [edi], 0x5457a0
mov dword [esp + 0x14], eax
mov edx, dword [eax]
lea ecx, [eax + 8]
mov dword [esp + 0x20], 3
mov eax, dword [ecx]
sub eax, edx
push eax
push edx
call fcn.004fdfd0
lea eax, [edi + 0x18]
mov dword [esp + 0x14], eax
mov edx, dword [eax]
lea ecx, [eax + 8]
mov dword [esp + 0x20], 4
mov eax, dword [ecx]
sub eax, edx
push eax
push edx
call fcn.004fdfd0
lea eax, [edi + 0xc]
mov dword [esp + 0x14], eax
mov edx, dword [eax + 8]
lea ecx, [eax + 8]
mov eax, dword [eax]
mov dword [esp + 0x20], 5
sub edx, eax
push edx
push eax
call fcn.004fdfd0
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x43bfc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52e84e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea edi, [esi + 0x40]
mov dword [esp + 0x10], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push 8
mov byte [esp + 0x20], 2
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov byte [eax], bl
mov edx, dword [0x57f4f8]
mov dword [esi + 0x14], edx
mov eax, dword [0x57f4fc]
mov dword [esi + 0x18], eax
mov ecx, dword [0x57f4f8]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x57f4fc]
mov dword [esi + 0x30], edx
mov ecx, dword [0x57f4d8]
lea eax, [esi + 0x34]
add esp, 4
mov dword [eax], ecx
mov edx, dword [0x57f4dc]
pop edi
mov dword [eax + 4], edx
mov ecx, dword [0x57f4e0]
mov dword [esi + 0x4c], ebx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x43bfd9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52e84e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea edi, [esi + 0x40]
mov dword [esp + 0x10], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push 8
mov byte [esp + 0x20], 2
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov byte [eax], bl
mov edx, dword [0x57f4f8]
mov dword [esi + 0x14], edx
mov eax, dword [0x57f4fc]
mov dword [esi + 0x18], eax
mov ecx, dword [0x57f4f8]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x57f4fc]
mov dword [esi + 0x30], edx
mov ecx, dword [0x57f4d8]
lea eax, [esi + 0x34]
add esp, 4
mov dword [eax], ecx
mov edx, dword [0x57f4dc]
pop edi
mov dword [eax + 4], edx
mov ecx, dword [0x57f4e0]
mov dword [esi + 0x4c], ebx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x43da00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x52ebc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 0xc]
mov dword [esp + 0x14], esi
mov dword [esi], 0x5455c8
mov byte [esi + 4], bl
mov dword [esp + 0x18], edi
lea eax, [esp + 0x12]
mov ecx, edi
push eax
mov dword [esp + 0x28], ebx
call fcn.0050e020
push 8
mov byte [esp + 0x28], 2
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], bl
lea ecx, [esi + 0x18]
mov dword [esp + 0x24], 3
call fcn.00405fe0
lea ebp, [esi + 0x24]
lea edx, [esp + 0x13]
push edx
mov ecx, ebp
mov byte [esp + 0x28], 5
mov dword [esp + 0x1c], ebp
call fcn.0050e020
mov edi, 0x5775c0
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x24], 6
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x5775c0
push ecx
push 0x5775c0
mov ecx, ebp
call fcn.004067c0
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov dword [esi], 0x546f38
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x453af0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x530618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], esi
lea ebp, [esi + esi + 2]
cmp ebp, eax
jge 0x453bfc
mov ecx, dword [esp + 0x2c]
lea eax, [ebp + ebp*2]
mov edi, dword [ecx + eax*4 - 0xc]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [ecx + eax*4]
mov ecx, dword [eax - 8]
mov eax, dword [eax]
sub ecx, edi
sub edx, eax
mov ebx, ecx
mov dword [esp + 0x14], edx
cmp ebx, edx
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
jl 0x453b5e
lea ecx, [esp + 0x14]
mov ecx, dword [ecx]
mov esi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x453b6d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x453b7c
cmp edx, ebx
jl 0x453b7e
cmp edx, ebx
setg al
test eax, eax
jge 0x453b7f
dec ebp
mov ecx, dword [esp + 0x2c]
lea edx, [ebp + ebp*2]
lea eax, [ecx + edx*4]
mov edx, dword [esp + 0x30]
lea edx, [edx + edx*2]
lea ecx, [ecx + edx*4]
cmp eax, ecx
je 0x453be2
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov esi, dword [ecx]
cmp eax, edi
je 0x453bc2
cmp esi, dword [ecx + 4]
je 0x453bbe
mov dl, byte [eax]
inc eax
mov byte [esi], dl
inc esi
cmp eax, edi
jne 0x453ba3
mov eax, dword [ecx + 4]
push eax
push esi
call fcn.00405c30
jmp 0x453be2
cmp eax, edi
jne 0x453bce
mov eax, dword [ecx + 4]
push eax
push esi
call fcn.00405c30
jmp 0x453be2
mov dl, byte [esp + 0x30]
mov byte [esp + 0x30], dl
lea edx, [esp + 0x30]
push edx
push edi
push eax
call fcn.00406a70
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, eax
jl 0x453b2c
mov esi, dword [esp + 0x30]
cmp ebp, eax
jne 0x453c75
mov ebx, dword [esp + 0x2c]
lea eax, [ebp + ebp*2]
lea ecx, [esi + esi*2]
lea eax, [ebx + eax*4 - 0xc]
lea ecx, [ebx + ecx*4]
cmp eax, ecx
je 0x453c6c
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov esi, dword [ecx]
cmp eax, edi
je 0x453c45
cmp esi, dword [ecx + 4]
je 0x453c41
mov dl, byte [eax]
inc eax
mov byte [esi], dl
inc esi
cmp eax, edi
jne 0x453c1f
mov eax, dword [ecx + 4]
push eax
push esi
call fcn.00405c30
dec ebp
mov dword [esp + 0x30], ebp
mov esi, ebp
jmp 0x453c79
cmp eax, edi
jne 0x453c58
mov eax, dword [ecx + 4]
push eax
push esi
call fcn.00405c30
dec ebp
mov dword [esp + 0x30], ebp
mov esi, ebp
jmp 0x453c79
mov dl, byte [esp + 0x30]
mov byte [esp + 0x30], dl
lea edx, [esp + 0x30]
push edx
push edi
push eax
call fcn.00406a70
dec ebp
mov dword [esp + 0x30], ebp
mov esi, ebp
jmp 0x453c79
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x38]
push eax
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
call fcn.0040ecd0
mov eax, dword [esp + 0x28]
push eax
push esi
push ebx
call fcn.004548a0
mov eax, dword [esp + 0x54]
add esp, 0x1c
test eax, eax
je 0x453cb1
push eax
call fcn.005265a0
add esp, 4
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret
Function at 0x46784a
Capabilities:
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5328e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
mov dword [esi], 0x547214
lea ecx, [esi + 0x64]
mov dword [esp + 0x2c], 3
call fcn.00418e50
lea ebp, [esi + 0x44]
mov ecx, ebp
mov dword [esp + 0x14], ecx
mov byte [esp + 0x2c], 4
call fcn.00418e50
lea ebx, [esi + 0x38]
mov byte [esp + 0x2c], 1
mov ecx, ebx
call fcn.00418e50
lea ecx, [esi + 0x18]
mov byte [esp + 0x2c], 0
call fcn.00418e50
lea edi, [esi + 0xc]
mov dword [esp + 0x2c], 0xffffffff
mov ecx, edi
call fcn.00418e50
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
test esi, esi
mov dword [esp + 0x2c], 5
je 0x4679ac
mov dword [esi], 0x547238
mov dword [esi + 4], 0
mov dword [esp + 0x20], edi
lea eax, [esp + 0x11]
mov ecx, edi
push eax
mov byte [esp + 0x30], 6
call fcn.0050e020
push 0x10
mov byte [esp + 0x30], 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 0x10]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov word [eax], 0
lea edi, [esi + 0x18]
mov dword [esp + 0x20], edi
lea edx, [esp + 0x12]
mov ecx, edi
push edx
mov byte [esp + 0x30], 0xa
call fcn.0050e020
push 8
mov byte [esp + 0x30], 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], 0
mov edi, ebx
mov dword [esp + 0x20], edi
lea edx, [esp + 0x13]
mov ecx, edi
push edx
mov byte [esp + 0x30], 0xe
call fcn.0050e020
push 8
mov byte [esp + 0x30], 0x10
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], 0
mov ecx, ebp
mov byte [esp + 0x2c], 0x11
call fcn.00405fe0
lea ecx, [esi + 0x64]
mov byte [esp + 0x2c], 0x12
call fcn.00405fe0
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 4]
add eax, edx
mov dword [esi], 0x547214
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, dword [esi + 4]
pop edi
add ecx, eax
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x468db0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x532f0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x14], esi
mov byte [esi], bl
lea eax, [esp + 0x13]
push ebx
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x2c], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.005124c0
lea edi, [esi + 0x14]
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x13]
lea ebp, [edi + 8]
push ebx
push ecx
mov ecx, ebp
mov byte [esp + 0x2c], 3
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.005124c0
push 8
mov byte [esp + 0x28], 5
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea edx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], edx
add esp, 4
mov byte [eax], bl
lea eax, [esp + 0x13]
push ebx
push eax
lea ecx, [esi + 0x28]
mov byte [esp + 0x2c], 7
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call fcn.005124c0
lea edi, [esi + 0x30]
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x13]
lea ebp, [edi + 8]
push ebx
push ecx
mov ecx, ebp
mov byte [esp + 0x2c], 0xa
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.005124c0
push 8
mov byte [esp + 0x28], 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
lea edx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], edx
add esp, 4
mov byte [eax], bl
mov byte [esp + 0x24], 0xe
mov dword [esi + 0x3c], ebx
lea eax, [esp + 0x13]
push ebx
push eax
lea ecx, [esi + 0x44]
mov dword [esi + 0x40], ebx
call fcn.005124c0
lea edi, [esi + 0x48]
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x13]
lea ebp, [edi + 8]
push ebx
push ecx
mov ecx, ebp
mov byte [esp + 0x2c], 0x11
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.005124c0
push 8
mov byte [esp + 0x28], 0x13
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x20]
lea edx, [eax + 8]
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], edx
mov byte [eax], bl
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret