joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40744e
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 8
call fcn.004537ef
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004537ef
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.004537ef
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4074fd
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.00459e40
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x407556
push 6
call fcn.004537fb
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00459ea0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x4075a1
push 6
call fcn.004537fb
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4075b1
push ebx
call fcn.004537f5
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x407645
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40766a
push 6
call fcn.004537fb
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x407672
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.004537f5
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004537f5
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004537f5
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40915a
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40919b
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x4091af
mov esp, ebp
pop ebp
ret 8
Function at 0x411abe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [0x5d894b]
mov dword [ebp - 4], ebx
push 0x47e2f1
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.0040216d
add esp, 8
cmp eax, 0
je 0x411b8f
mov ebx, dword [0x5d894b]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00459ea0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00459ea0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x411b6f
push 6
call fcn.004537fb
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x411b7f
push ebx
call fcn.004537f5
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x411b8f
push ebx
call fcn.004537f5
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41dc2b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41dc5b
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x41dc6f
mov esp, ebp
pop ebp
ret 4

Function at 0x41dcbf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x5d8a1b], 0
jle 0x41dcf7
cmp dword [0x5d8a07], 0
jle 0x41dcf7
mov eax, 1
jmp 0x41dcf9
xor eax, eax
test eax, eax
je 0x41ddd1
push 1
push dword [0x5d8a1b]
call fcn.0041ddd7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x41ddb8
push 0x5d8a17
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
call fcn.00401b8b
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [0x5d8a07]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41dd5e
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41dda4
mov dword [ebp - 0xc], esp
push dword [0x5d8a07]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41dd90
push 6
call fcn.004537fb
add esp, 4
mov dword [0x5d8a07], 0
mov dword [0x5d8a1b], 0
push 0x5d8a17
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
jmp 0x41ddd1
cmp dword [ebp - 4], 0
jne 0x41ddd1
push 0x5d8aaf
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ee9c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00459e60
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41eee1
push ebx
call fcn.004537f5
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00409011
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41ef20
push 6
call fcn.004537fb
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x41ef3c
push eax
mov ebx, eax
call fcn.00401124
inc eax
push eax
call fcn.004537ef
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41ef41
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41ef52
push ebx
call fcn.004537f5
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x422d9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x5d893b]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x422de9
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x422e00
mov eax, 0x47e3d3
jmp 0x422efe
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x5d893b]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x422e28
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x422e3f
mov eax, 0x47e3d3
jmp 0x422efe
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x422e61
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x422e78
mov eax, 0x47e3d3
jmp 0x422efe
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.0045a750
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x422eab
push ebx
call fcn.004537f5
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x422ec2
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x422edf
push 6
call fcn.004537fb
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x422ef9
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004537ef
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x422efe
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x422f0f
push ebx
call fcn.004537f5
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4294de
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x429519
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045a620
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42957c
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00459e40
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4295a0
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045a620
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x429603
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00459e40
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x429627
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045a620
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42968a
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00459e40
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x429692
mov esp, ebp
pop ebp
ret
Function at 0x42db27
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42db6d
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x47e337]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.004011eb
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00459e60
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42dbc0
push ebx
call fcn.004537f5
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42dbf9
push 6
call fcn.004537fb
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x42dc15
push eax
mov ebx, eax
call fcn.00401124
inc eax
push eax
call fcn.004537ef
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42dc1a
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42dc2b
push ebx
call fcn.004537f5
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x435a03
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push VariantCopy
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x435a2f
mov eax, 0x47e3d3
push eax
push 1
mov ebx, 0x194
call fcn.0045b4c0
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x435a76
push 6
call fcn.004537fb
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x435a8b
add eax, 8
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x435aab
push 6
call fcn.004537fb
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x435ab3
mov esp, ebp
pop ebp
ret 4
Function at 0x457e00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477480
push 0x4606fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x457e66
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x457eef
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x457e8d
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x457eef
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x457ec8
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x457ec8
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x457eef
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x457eef
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x457f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5dc818]
mov dword [ebp - 4], eax
jmp 0x457fa9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x457fc6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x457fa0
mov esp, ebp
pop ebp
ret
Function at 0x457fd0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5dc828], eax
je 0x457fee
mov eax, 0x10dd
jmp 0x4580d0
mov eax, dword [0x5dc838]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45806d
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x45804b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x45804b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.00458140
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0046bf62
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x457ff6
mov dword [0x5dc838], 0
call fcn.004580e0
mov ecx, dword [0x5dc834]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x4580ba
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0046bf62
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x458085
mov dword [0x5dc834], 0
mov dword [0x5dc828], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x458640
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x458655
xor eax, eax
jmp 0x4586ca
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x458682
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x4586c5
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x4586c3
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x4586bf
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x4586c3
xor eax, eax
jmp 0x4586ca
jmp 0x458679
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x458780
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5dc82c], 0
je 0x458799
mov eax, dword [0x5dc82c]
jmp 0x458839
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x4587ab
xor eax, eax
jmp 0x458839
push 8
call fcn.0046bf39
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x458801
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x4587ea
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0046bf62
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x5dc82c], eax
mov dword [0x5dc830], 0
mov eax, dword [ebp - 8]
jmp 0x458839
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x45881b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x4587cb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x5dc834]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x5dc834], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x459080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00459150
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x45913c
cmp dword [ebp - 4], 0x50000000
jb 0x4590bc
cmp dword [ebp - 4], 0x80000000
ja 0x4590bc
mov dword [ebp - 4], 0x80010000
jmp 0x459095
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004607e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4590e2
jmp 0x45913c
cmp dword [ebp - 0x10], 0x10000
jne 0x459125
cmp dword [ebp - 0x14], 0x10000
jb 0x459125
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x459118
mov eax, dword [ebp - 0x24]
jmp 0x45913e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x459137
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00459150
add esp, 4
mov dword [ebp - 4], eax
jmp 0x459095
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x459190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00459260
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x459254
cmp dword [ebp - 4], 0x50000000
jb 0x4591d1
cmp dword [ebp - 4], 0x80000000
ja 0x4591d1
mov dword [ebp - 4], 0x4fff0000
jmp 0x4591aa
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004607e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4591f7
jmp 0x459254
cmp dword [ebp - 0x10], 0x10000
jne 0x45923a
cmp dword [ebp - 0x14], 0x10000
jb 0x45923a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x45922d
mov eax, dword [ebp - 0x24]
jmp 0x459256
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x45924f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00459260
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4591aa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x45a0f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x45a10e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x45a103
pop esi
ret