joyce8/EMBER2024-capa huggingface dataset:
Function at 0x598449a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x59844b16
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrClr_qqrpv
push 0x59858104
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x59844ae7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, esi
call sub.rtl120.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
push 0
mov edx, edi
lea eax, [ebp - 8]
mov ecx, ebx
call sub.rtl120.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
cmp ebx, eax
jne 0x59844add
lea eax, [ebp - 8]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
cmp ebx, eax
jne 0x59844add
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__LStrEqual_qqrv
je 0x59844add
lea eax, [ebp - 0x10]
push eax
push 0x40
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x59844add
mov edx, esi
mov eax, edi
mov ecx, ebx
call sub.rtl120.bpl__System_Move_qqrpxvpvi
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0x5985811c]
call sub.rtl120.bpl__System__DynArrayLength_qqrv
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, 0x5985811c
mov ecx, 1
mov edx, dword [0x59844980]
call sub.rtl120.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov edi, ebx
add edi, edi
mov eax, dword [0x5985811c]
mov dword [eax + edi*8], esi
mov eax, dword [0x5985811c]
lea eax, [eax + edi*8 + 4]
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
mov eax, dword [0x5985811c]
lea eax, [eax + edi*8 + 8]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
mov eax, dword [0x5985811c]
mov edx, dword [ebp + 8]
mov dword [eax + edi*8 + 0xc], edx
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59844af1
push 0x59858104
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59844b1d
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x59844b2c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59844c5a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x59858104
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x5985811c]
call sub.rtl120.bpl__System__DynArrayHigh_qqrv
test eax, eax
jl 0x59844c2b
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add eax, eax
mov edx, dword [0x5985811c]
lea ebx, [edx + eax*8]
xor eax, eax
push ebp
push 0x59844c15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov edx, eax
mov eax, dword [ebx]
call sub.madBasic_.bpl__Madtools_IsBadReadPtr2_qqrpvui
test al, al
jne 0x59844c0b
push 0
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 8]
call sub.rtl120.bpl__System__LStrEqual_qqrv
jne 0x59844c0b
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x59844c0b
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__System_Move_qqrpxvpvi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59844c1f
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x59844b6f
push 0x59858104
call sub.kernel32.dll_LeaveCriticalSection
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59844c61
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret
Function at 0x59844c68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59844d96
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x59858104
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x5985811c]
call sub.rtl120.bpl__System__DynArrayHigh_qqrv
test eax, eax
jl 0x59844d67
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add eax, eax
mov edx, dword [0x5985811c]
lea ebx, [edx + eax*8]
xor eax, eax
push ebp
push 0x59844d51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov edx, eax
mov eax, dword [ebx]
call sub.madBasic_.bpl__Madtools_IsBadReadPtr2_qqrpvui
test al, al
jne 0x59844d47
push 0
mov eax, dword [ebx + 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 4]
call sub.rtl120.bpl__System__LStrEqual_qqrv
jne 0x59844d47
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x59844d47
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System_Move_qqrpxvpvi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 8]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59844d5b
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x59844cab
push 0x59858104
call sub.kernel32.dll_LeaveCriticalSection
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59844d9d
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret
Function at 0x598484b8
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId
cmp esi, eax
je 0x598484e2
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
cmp esi, 0xffffffff
je 0x598484e2
push edi
call sub.kernel32.dll_ResumeThread
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5984d658
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x5984d768
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x5984d748
mov eax, ebx
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
xor ecx, ecx
mov edx, dword [ebp - 4]
call sub.madBasic_.bpl__Madtools_GetImageProcAddress_qqruix27System__AnsiStringT_us_i0__o
mov dword [edi], eax
test esi, esi
je 0x5984d6b6
cmp word [esi], 0x25ff
jne 0x5984d6b6
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x5984d6b8
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x5984d6d6
push 0
call sub.kernel32.dll_GetModuleHandleW
cmp eax, dword [0x59857198]
je 0x5984d6d6
cmp byte [0x598571a4], 0
je 0x5984d6ed
lea eax, [ebp - 0x10]
call fcn.5981a578
mov eax, dword [ebp - 0x10]
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
call fcn.5981a9cc
jmp 0x5984d6fc
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x59857198]
call fcn.5981a914
test ebx, ebx
je 0x5984d70b
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x5984d70f
xor eax, eax
jmp 0x5984d711
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x5984d74c
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5984d74c
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x5984d74c
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5984d76f
lea eax, [ebp - 0x10]
mov edx, dword [0x5981a54c]
call sub.rtl120.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x5984d77c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5984d857
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x5984d83b
test esi, esi
je 0x5984d7bd
cmp word [esi], 0x25ff
jne 0x5984d7bd
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x5984d7bf
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x5984d7dd
push 0
call sub.kernel32.dll_GetModuleHandleW
cmp eax, dword [0x59857198]
je 0x5984d7dd
cmp byte [0x598571a4], 0
je 0x5984d7f4
lea eax, [ebp - 0xc]
call fcn.5981a578
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.5981a9cc
jmp 0x5984d803
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x59857198]
call fcn.5981a914
test ebx, ebx
je 0x5984d83b
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x5984d83b
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5984d83b
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5984d85e
lea eax, [ebp - 0xc]
mov edx, dword [0x5981a54c]
call sub.rtl120.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x5984e074
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [sym.imp.madDisAsm_.bpl___xp_23Maddisasm_TFunctionInfo]
call sub.rtl120.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x5984e1e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x49], 0
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea edx, [ebp - 0x40]
mov eax, ebx
call sub.madDisAsm_.bpl__Maddisasm_ParseFunction_qqrpv
cmp byte [ebp - 0x40], 0
je 0x5984e1c8
mov eax, dword [ebp - 0x20]
call sub.rtl120.bpl__System__DynArrayHigh_qqrv
test eax, eax
jl 0x5984e1c8
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x44]
jne 0x5984e1c0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp byte [eax], 0xe8
jne 0x5984e162
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5984e1c8
mov edx, dword [ebp + 0x14]
mov eax, dword [ebx + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
sub edx, dword [ebx + 8]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 0x18]
mov edx, dword [ebx + 0xc]
mov dword [eax], edx
mov byte [ebp - 0x49], 1
jmp 0x5984e1c8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp word [eax], 0x15ff
jne 0x5984e1c8
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5984e1c8
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 0x18]
mov edx, dword [ebx + 0xc]
mov dword [eax], edx
mov byte [ebp - 0x49], 1
jmp 0x5984e1c8
inc esi
dec eax
jne 0x5984e0e7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5984e1eb
lea eax, [ebp - 0x40]
mov edx, dword [sym.imp.madDisAsm_.bpl___xp_23Maddisasm_TFunctionInfo]
call sub.rtl120.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x5984e454
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov byte [0x59857b40], 0
cmp dword [0x59857b44], 0
je 0x5984e49b
push esp
push 0x40
push 4
mov eax, dword [0x59857b44]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5984e4f1
mov eax, dword [0x59857b44]
mov edx, dword [0x59857b48]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x59857b44]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x5984e4f1
cmp dword [0x59857b4c], 0
je 0x5984e4da
push esp
push 0x40
push 4
mov eax, dword [0x59857b4c]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5984e4f1
mov eax, dword [0x59857b4c]
mov edx, dword [0x59857b50]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x59857b4c]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x5984e4f1
push 0
mov ecx, 0x5984dd8c
mov eax, sub.kernel32.dll_CreateThread
mov edx, dword [0x59857b38]
call sym.madExcept_.bpl__Madexcept_UnpatchAPI_qqrpvt1t1o
push 0
mov ecx, 0x5984e048
mov edx, dword [0x59857b3c]
xor eax, eax
call sym.madExcept_.bpl__Madexcept_UnpatchAPI_qqrpvt1t1o
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
ret

Function at 0x5984eb48
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov esi, eax
lea eax, [ebp - 8]
mov edx, dword [0x5984ea18]
call sub.rtl120.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x5984ec27
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x5984ec34
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x5984ebfe
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call sub.madBasic_.bpl__Madstrings_IntToHexExA_qqruiic
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x5984ec4c
call sub.rtl120.bpl__System__LStrCat3_qqrv
lea edx, [ebp - 0x10]
mov eax, esi
call sub.madBasic_.bpl__Madstrings_EncodeUtf8_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrLAsg_qqrpvpxv
lea eax, [ebp - 4]
mov edx, 0x5984ec74
call sub.rtl120.bpl__System__LStrCat_qqrv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
cmp eax, 0x104
jge 0x5984ebf0
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call sub.rtl120.bpl__System__LStrSetLength_qqrv
lea eax, [ebp - 8]
push eax
push 0x5984ea50
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5984ec2e
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, dword [0x5984ea18]
call sub.rtl120.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x5984fae8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5984fbbd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call sub.madBasic_.bpl__Madstrings_IntToHexExA_qqruiic
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x5984fbd8
call sub.rtl120.bpl__System__LStrCat3_qqrv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x5984fba2
mov byte [sym.madExcept_.bpl__Madexcept_WasRestarted], 1
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x5984fb9c
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x5984fb84
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle
mov edx, 0x598571f8
lea eax, [esi + 8]
mov ecx, 0x50
call sub.rtl120.bpl__System_Move_qqrpxvpvi
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5984fbc4
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x598500f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59850288
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, 0x59850298
mov ecx, 0x598502ac
mov eax, ebx
call sub.madBasic_.bpl__Madtools_ResToStr_qqruipbx20System_UnicodeString
lea eax, [ebp - 4]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
cmp eax, 0x14
jne 0x59850272
cmp ebx, dword [0x59857198]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x59850272
mov eax, ebx
call sub.madBasic_.bpl__Madtools_GetImageNtHeaders_qqrui
mov esi, eax
cmp word [esi + 0x18], 0x20b
jne 0x598501da
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x59857198]
jne 0x59850197
mov eax, sym.madExcept_.bpl__Madexcept_CalibrateCode_qqrv
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
jmp 0x598501a4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x59850263
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x59857198]
jne 0x59850217
mov eax, sym.madExcept_.bpl__Madexcept_CalibrateCode_qqrv
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
mov eax, sym.madExcept_.bpl__Madexcept_CalibrateData
mov edx, dword [ebp - 4]
sub eax, dword [edx + 4]
sub eax, ebx
mov dword [esi + 0x30], eax
jmp 0x59850232
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5985028f
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret