joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bcc0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push edi
push 0
push 0
mov edi, eax
mov eax, dword [esi + 4]
push 0xb
push eax
call ebx
mov ecx, dword [esi + 0x24]
push 0
push 0
push 0x1304
push ecx
call ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
cmp eax, 1
jne 0x40bd07
mov edx, dword [esi + 0x24]
push 0
push edx
call ebp
mov eax, dword [esi + 0xb4]
push 0
push eax
call ebp
mov edx, dword [esi + 0x24]
xor eax, eax
test byte [esi + 0x7c], 1
lea ecx, [esp + 0x18]
push ecx
push edi
push 0x133c
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
push edx
je 0x40bd55
call ebx
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x40bd60
call ebx
mov eax, dword [esp + 0x30]
push 0
push eax
call ebp
mov edx, dword [esi + 0x24]
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
push edi
push 0x133c
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x28], 8
call ebx
neg eax
sbb eax, eax
and eax, dword [esp + 0x34]
push eax
call fcn.0041cb06
mov eax, dword [esi + 0x24]
add esp, 4
push 0
push edi
push 0x1308
push eax
call ebx
mov eax, dword [esi + 0x50]
cmp edi, eax
jne 0x40be22
mov dword [esi + 0x50], 0xffffffff
test edi, edi
jle 0x40bdd0
dec edi
push edi
jmp 0x40be2d
mov ecx, dword [esi + 0x24]
push 0
push 0
push 0x1304
push ecx
call ebx
test eax, eax
jg 0x40bdcd
mov edx, dword [esi + 4]
push 0
push 1
push 0xb
push edx
call ebx
mov eax, dword [esi + 4]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea edi, [esi + 0xb8]
call fcn.004030f0
mov edi, esi
call fcn.0040c7a0
mov ecx, esi
call fcn.0040fc20
jmp 0x40be34
jge 0x40be25
dec eax
mov dword [esi + 0x50], 0xffffffff
push eax
mov eax, esi
call fcn.0040b850
mov edx, dword [esi + 0x50]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0xfffffd1b
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 0xc]
push ecx
push edi
push 0x4e
push eax
call ebx
pop edi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x40be80
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x24]
sub esp, 0x30
push ebx
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1304
push eax
call edi
test eax, eax
je 0x40c064
mov ecx, dword [esi + 4]
push 0
push 0
push 0xb
push ecx
call edi
mov edx, dword [esi + 0x24]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call ebx
mov eax, dword [esi + 0xb4]
push 0
push eax
call ebx
mov ecx, dword [esi + 0x24]
xor ebp, ebp
push ebp
push ebp
push 0x1304
push ecx
call edi
test eax, eax
jle 0x40bf9d
mov ebx, 8
xor eax, eax
test byte [esi + 0x7c], 1
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x24]
push 0x133c
mov dword [esp + 0x24], ebx
push eax
je 0x40bf2e
call edi
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x40bf3d
call edi
mov ecx, dword [esp + 0x30]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x24]
push 0x133c
push eax
mov dword [esp + 0x28], ebx
call edi
neg eax
sbb eax, eax
and eax, dword [esp + 0x34]
push eax
call fcn.0041cb06
mov ecx, dword [esi + 0x24]
add esp, 4
push 0
push 0
push 0x1304
push ecx
inc ebp
call edi
cmp ebp, eax
jl 0x40bee4
mov edx, dword [esi + 0x24]
push 0
push 0
push 0x1309
push edx
call edi
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
or ecx, 0xffffffff
push eax
mov dword [esi + 0x50], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0xfffffd1b
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 0xc]
push ecx
push ebx
push 0x4e
push eax
call edi
mov edx, dword [esi + 4]
push 0
push 1
push 0xb
push edx
call edi
mov eax, dword [esi + 4]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea edi, [esi + 0xb8]
call fcn.004030f0
mov edi, esi
call fcn.0040c7a0
mov edi, dword [esi + 0x60]
test edi, edi
je 0x40c064
mov al, byte [esi + 0x7c]
mov dl, al
shr dl, 3
and dl, 1
movzx ecx, dl
mov dl, al
shr dl, 2
push ecx
and dl, 1
movzx ecx, dl
mov dl, al
push ecx
shr dl, 5
and dl, 1
shr al, 4
movzx ecx, dl
and al, 1
movzx edx, al
mov eax, dword [esi + 0x68]
push ecx
push edx
push eax
push esi
call fcn.0040c100
pop edi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x40e760
Capabilities:
Capture webcam image

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
call edi
cmp eax, dword [esi + 4]
je 0x40e792
test byte [esi + 0x58], 4
je 0x40e788
cmp dword [esi + 0xac], 0
jne 0x40e788
call edi
mov dword [esi + 0xac], eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0xc]
mov edx, dword [esi + 4]
push 0
push eax
push 0x419
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [esi + 0x84], 0xcf
push 1
push eax
call fcn.00410d70
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x40e7d0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0xa8]
mov dword [edi], 0
cmp eax, 0x12
je 0x40e802
cmp eax, 0x79
jne 0x40e7f5
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40e802
cmp dword [esi + 0xa8], 0x20
jne 0x40e892
cmp dword [esp + 8], 0xf100
jne 0x40e892
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x40e842
mov eax, esi
call fcn.00411790
mov eax, dword [esi + 4]
push 0
push 0xffffffffffffffff
push 0x448
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
and byte [esi + 0x84], 0xbf
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x40e892
test byte [esi + 0x84], 0x40
jne 0x40e887
mov al, byte [esi + 0x85]
test al, 2
je 0x40e86f
test al, 4
jne 0x40e86f
test al, 8
je 0x40e86f
mov al, 1
call fcn.00411820
call fcn.00411760
and byte [esi + 0x84], 0xbf
mov dword [edi], 1
xor eax, eax
pop esi
ret 4
cmp eax, 0x20
je 0x40e892
mov dword [edi], 1
and byte [esi + 0x84], 0xbf
xor eax, eax
pop esi
ret 4
Function at 0x414390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4143a7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4143d8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4143d4
cmp esi, eax
jae 0x4143d8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4143c4
cmp esi, eax
jb 0x4143de
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x414580
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0
push 0x4336dc
push ecx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4145b9
mov eax, dword [esp + 8]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 4

Function at 0x41aa10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x41aa20
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x41aa30
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x41aec0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x43a070]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
mov ebp, dword [esp + 0x234]
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea edx, [esp + 0x20]
push edx
xor edi, edi
or eax, 0x2001f
push eax
push edi
push ebp
push ecx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, edi
jne 0x41af35
xor eax, eax
cmp ecx, edi
je 0x41af23
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], edi
mov esi, eax
mov dword [esp + 0x14], ecx
cmp eax, edi
je 0x41af43
cmp ecx, edi
je 0x41afe0
push ecx
jmp 0x41afda
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x28]
push eax
push edi
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push edi
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x41afae
jmp 0x41af70
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x18]
call fcn.0041aec0
mov ebp, eax
cmp ebp, edi
jne 0x41affd
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
push ecx
push edi
push edx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x41af70
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41afc1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov eax, dword [ebx]
push ebp
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41afe0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041cac6
add esp, 0x228
ret 4
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x41b00c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x41afe2
Function at 0x41ba50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x43a070]
xor eax, esp
mov dword [esp + 0x420], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
xor ecx, ecx
push 2
push ecx
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41baa3
call fcn.0041a3e0
mov esi, eax
jmp 0x41bb78
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41babc
call fcn.0041a3e0
jmp 0x41bb6f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x41bad6
call fcn.0041a3e0
jmp 0x41bb6f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x41bb1f
lea eax, [esp + 0x24]
cmp dword [esp + 0x20], eax
je 0x41bafa
lea eax, [esp + 0x20]
call fcn.0040d690
lea esi, [esp + 0x14]
call fcn.0041aa60
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0041cac6
mov esp, ebp
pop ebp
ret 0xc
lea esi, [esp + 0x20]
call fcn.0041a3a0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x41bb37
mov esi, 0x8007000e
jmp 0x41bb71
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ebx
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x41bb54
call fcn.0041a3e0
jmp 0x41bb6f
mov ecx, dword [esp + 0x20]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 0x20]
push edx
lea edx, [esp + 0x1c]
call fcn.0041b900
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x24]
cmp dword [esp + 0x20], eax
je 0x41bb90
lea eax, [esp + 0x20]
call fcn.0040d690
jmp 0x41bb90
mov ecx, dword [esp + 0x42c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0041cac6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41c1a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x43a070]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0x114
call fcn.0041e460
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41c1ff
cmp dword [esp + 4], 6
jb 0x41c1ff
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041cac6
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.0041cac6
add esp, 0x118
ret
Function at 0x41c3b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x43a070]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.0041e460
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41c41a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x41c403
cmp eax, 4
jne 0x41c41a
cmp dword [esp + 8], 0x5a
jb 0x41c41a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041cac6
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.0041cac6
add esp, 0x118
ret

Function at 0x41c719
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x43d458], 0
push esi
jne 0x41c68c
call fcn.0041c5b2
test eax, eax
je 0x41c6cf
mov eax, dword [0x43d458]
cmp eax, 1
jne 0x41c6ad
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41c6cf
pop esi
ret
push eax
call dword [0x43d460]
test eax, eax
jne 0x41c717
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41c6d3
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x43d458]
call dword [0x43d460]
mov edi, eax
test edi, edi
je 0x41c6f8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41c714
mov edi, esi
add esi, 0xff0
push edi
push dword [0x43d458]
call dword [0x43d45c]
add edi, 0x10
cmp edi, esi
jb 0x41c700
mov eax, edi
pop edi
pop esi
ret
jmp 0x41c679

Function at 0x41cac6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a070]
jne 0x41cad0
repz ret
jmp fcn.0041e6cc
Function at 0x426017
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00420bac
and dword [ebp - 4], 0
cmp dword [0x43dfb4], 0
mov ebx, eax
jne 0x4260c8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x426179
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x426179
push eax
call fcn.00420b3a
mov dword [esp], 0x4316c0
push edi
mov dword [0x43dfb4], eax
call esi
push eax
call fcn.00420b3a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43dfb8], eax
call esi
push eax
call fcn.00420b3a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43dfbc], eax
call esi
push eax
call fcn.00420b3a
pop ecx
mov dword [0x43dfc4], eax
test eax, eax
je 0x4260c8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00420b3a
pop ecx
mov dword [0x43dfc0], eax
mov eax, dword [0x43dfc0]
cmp eax, ebx
je 0x426120
cmp dword [0x43dfc4], ebx
je 0x426120
push eax
call fcn.00420bb5
push dword [0x43dfc4]
mov esi, eax
call fcn.00420bb5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x426120
test edi, edi
je 0x426120
call esi
test eax, eax
je 0x426117
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x426117
test byte [ebp - 0xc], 1
jne 0x426120
or dword [ebp + 0x10], 0x200000
jmp 0x426159
mov eax, dword [0x43dfb8]
cmp eax, ebx
je 0x426159
push eax
call fcn.00420bb5
pop ecx
test eax, eax
je 0x426159
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x426159
mov eax, dword [0x43dfbc]
cmp eax, ebx
je 0x426159
push eax
call fcn.00420bb5
pop ecx
test eax, eax
je 0x426159
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43dfb4]
call fcn.00420bb5
pop ecx
test eax, eax
je 0x426179
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42617b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42a1b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43e094]
mov dword [ebp - 4], eax
jmp 0x42a1c9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x42a1e6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x42a1c0
mov esp, ebp
pop ebp
ret
Function at 0x42a1f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x43e0a4], eax
je 0x42a20e
mov eax, 0x10dd
jmp 0x42a2ef
mov eax, dword [0x43e0b4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a28c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x42a26a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x42a26a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.0042a360
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0041cabb
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x42a216
mov dword [0x43e0b4], 0
call fcn.0042a300
mov ecx, dword [0x43e0b0]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x42a2d9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0041cabb
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x42a2a4
mov dword [0x43e0b0], 0
mov dword [0x43e0a4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42a860
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x42a875
xor eax, eax
jmp 0x42a8ea
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x42a8a2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x42a8e5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x42a8e3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x42a8df
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x42a8e3
xor eax, eax
jmp 0x42a8ea
jmp 0x42a899
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x42a990
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x43e0a8], 0
je 0x42a9a9
mov eax, dword [0x43e0a8]
jmp 0x42aa49
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x42a9bb
xor eax, eax
jmp 0x42aa49
push 8
call fcn.0041cd22
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42aa11
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x42a9fa
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0041cabb
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x43e0a8], eax
mov dword [0x43e0ac], 0
mov eax, dword [ebp - 4]
jmp 0x42aa49
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x42aa2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42a9db
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x43e0b0]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x43e0b0], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4