joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b8af
mov eax, dword [esi + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x40b81d
push eax
call fcn.0040b800
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x40b8d5
cmp byte [esi + 0x10], 0
jne 0x40b884
mov edi, dword [esi + 0x14]
test edi, edi
je 0x40b884
push ebx
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x40b8b3
mov eax, dword [edi + 8]
pop ebx
cmp eax, 8
je 0x42ba02
cmp eax, 0xa
je 0x42ba23
cmp eax, 5
je 0x40b8f8
cmp eax, 0xb
je 0x42ba38
cmp eax, 0xc
je 0x42ba53
push edi
mov dword [edi + 8], 1
mov dword [edi], 0
call fcn.004112ef
add esp, 4
mov eax, dword [esi + 0xc]
dec dword [eax]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0
pop edi
jne 0x40b8a6
mov edx, dword [esi]
push edx
call fcn.004112ef
mov eax, dword [esi + 0xc]
push eax
call fcn.004112ef
add esp, 8
push esi
call fcn.004112ef
add esp, 4
pop esi
ret 4
mov eax, dword [ebx + 0xc]
dec dword [eax]
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x40b8e2
push ebx
call fcn.004112ef
add esp, 4
mov dword [edi + 0xc], 0
jmp 0x40b83d
push eax
mov ecx, edi
call fcn.0040b800
jmp 0x40b828
mov ecx, dword [ebx]
push ecx
call fcn.004112ef
mov edx, dword [ebx + 0xc]
push edx
call fcn.004112ef
add esp, 8
jmp 0x40b8c0
mov eax, edi
call fcn.0040e380
jmp 0x40b86e
call dword [eax - 0x18]
push esp
loopne 0x42ba28
invalid
call [ecx + 0x50]
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00429a33
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x42ba51
invalid
jmp fcn.0042b410
cmp dword [ebp - 0x37c], 0
je 0x42ba5f
test ah, bh
invalid
jmp fcn.0042bb14
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
Function at 0x40d2d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push ebp
mov esi, eax
call fcn.004112d5
mov edi, eax
mov eax, dword [esi + 0xc]
add esp, 4
cmp dword [eax], 1
jg 0x42a195
mov eax, dword [esi + 4]
add eax, edi
call fcn.004034b0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
lea eax, [edi + edi]
push eax
lea eax, [edx + ecx*2]
push ebp
push eax
call fcn.00410f70
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
add esp, 0xc
xor edx, edx
pop edi
mov word [ecx + eax*2], dx
mov eax, esi
pop esi
pop ebp
ret 4
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x42a145
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x42a163
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x42a1c1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
and byte [ecx + 0x1065], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x42a1a8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x42a1b1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x42a1bb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x42a19d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x42a127
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40d6d0
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00401f80
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x431a9d
mov eax, dword [0x4a7cfc]
test eax, eax
je 0x431ab6
mov byte [esp + 0xf], 0
mov esi, 0x4a8e80
cmp eax, 1
je 0x431aca
push 0x4a7cfc
lea ecx, [esp + 0x13]
mov eax, 0x4a7d14
call fcn.0040f3b0
test al, al
je 0x431aeb
mov dl, byte [0x4a8e80]
mov bl, byte [0x4a8e81]
push 0x4a7cf8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a7d14
mov byte [0x4a7d00], dl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [0x4a7cfc]
push ecx
push 0x4a7d14
call fcn.00401440
test eax, eax
jne 0x431aff
cmp bl, 1
je 0x431b23
call fcn.004101f0
call fcn.004103e0
cmp byte [0x4a7d00], 0
jne 0x40d7a8
mov esi, 0x4a84b8
call fcn.0040e1e0
push 1
mov ecx, 0x4a7f20
call fcn.00409560
cmp byte [0x4a7d00], 0
jne 0x40d7c7
mov ecx, 0x4a84b8
call fcn.00401000
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
push 0x10
push 0x4846d6
push 0x4846d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40d7dc
lea ecx, [esp + 0x20]
mov dword [0x49729c], 0xffffffff
push ecx
jmp 0x40d7d6
mov edx, dword [0x4a7d04]
push 0xffffffffffffffff
push edx
push 1
xor bl, bl
call fcn.00403e90
mov al, byte [0x497290]
mov byte [0x4a8e83], al
jmp 0x40d769
lea ecx, [esp + 0x20]
mov dword [0x49729c], 1
push ecx
jmp 0x40d7d6
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x49729c], 1
jmp 0x40d7dc
call fcn.0043604b
test al, al
jne 0x40d78b
push 0x104
lea eax, [esp + 0x234]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [esp + 0xf], 0
je 0x431ba4
mov edi, 0x484740
lea esi, [esp + 0x10]
call fcn.00401b70
mov edi, 0x4a7d14
mov eax, esi
call fcn.0040d330
mov edi, 0x484740
mov eax, esi
call fcn.0040d330
mov edx, dword [esp + 0x10]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x23c]
push eax
push 0x484744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00402620
jmp 0x40d7c7
push 1
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x23c]
push edx
push 0x484744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40d7c7

Function at 0x40e700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [esi + 0x16c], 0
push ebx
push edi
jne 0x42a639
cmp byte [0x4a7cc1], 0
jne 0x42a64e
lea ebx, [esi + 0x488]
mov edi, 0x4848e8
call fcn.0040e6d0
cmp byte [0x4a7cc2], 0
pop edi
pop ebx
jne 0x42a675
ret
in al, 0xfa
invalid
out 0xfa, eax
invalid
or al, 0x89
test dword [esp + edi*8 - 1], esp
invalid
Function at 0x40f040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 8
mov eax, dword [eax + 4]
mov dword [esp], eax
lea esp, [esp]
test eax, eax
jne 0x429d41
add esp, 8
ret

Function at 0x40f0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esi]
test eax, eax
jne 0x42a721
mov dword [esi + 8], 0
ret

Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40f1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0
jne 0x40f1ba
lea ecx, [esp + 0xc]
call fcn.00402620
xor eax, eax
pop edi
pop ecx
ret 0x10
push ebx
push esi
lea esi, [esp + 0x14]
call fcn.00410a40
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x42a935
mov esi, dword [edi]
test esi, esi
je 0x40f1ee
lea eax, [esp + 0x14]
call fcn.0040dd00
test al, al
jne 0x42a925
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x40f1d6
lea ecx, [esp + 0x14]
call fcn.00402620
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret 0x10
int1
invalid
Function at 0x40f790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
lea ebx, [edi + 0x44]
push esi
mov edx, 8
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.0040f850
mov ecx, dword [ebx]
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
jae 0x42a349
mov eax, 0x38
sub eax, ecx
push 0x492388
mov ecx, edi
call fcn.0040f700
lea eax, [esp + 0x10]
push eax
mov eax, 8
mov ecx, edi
call fcn.0040f700
lea esi, [edi + 0x34]
mov edx, 0x10
mov eax, esi
mov ecx, edi
call fcn.0040f850
push 8
push 0
push ebx
call fcn.004131f0
push 0x10
push 0
push esi
call fcn.004131f0
push 0x40
lea ecx, [edi + 0x4c]
push 0
push ecx
call fcn.004131f0
lea ebx, [edi + 0x10]
add esp, 0x24
mov byte [ebx], 0
xor esi, esi
movzx edx, byte [esi + edi]
push edx
lea eax, [esp + 0x10]
push str._02X
push eax
call fcn.00415258
lea ecx, [esp + 0x18]
push ecx
push ebx
call fcn.004139a0
inc esi
add esp, 0x14
cmp esi, 0x10
jl 0x40f820
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
ror byte [ebp - 0x33243], 0xff

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x4107b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x10
mov dword [edi + 8], 4
call fcn.0041171a
add esp, 4
test eax, eax
je 0x429e18
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax + 0xc], ecx
inc dword [ecx]
mov dword [edi + 0xc], eax
mov eax, edi
ret
cld
invalid

Function at 0x4107f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esi]
test eax, eax
jne 0x42a2ba
mov dword [esi + 8], 0
ret
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25

Function at 0x4108c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [eax + 4]
test eax, eax
jne 0x42a2f4
ret
cld
invalid

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243
Function at 0x422f38
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004169e0
and dword [ebp - 4], 0
cmp dword [0x496efc], 0
mov ebx, eax
jne 0x422fe9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42309a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x483de0
push edi
call esi
test eax, eax
je 0x42309a
push eax
call fcn.0041696e
mov dword [esp], 0x483dd0
push edi
mov dword [0x496efc], eax
call esi
push eax
call fcn.0041696e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x496f00], eax
call esi
push eax
call fcn.0041696e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x496f04], eax
call esi
push eax
call fcn.0041696e
pop ecx
mov dword [0x496f0c], eax
test eax, eax
je 0x422fe9
push 0x483d88
push edi
call esi
push eax
call fcn.0041696e
pop ecx
mov dword [0x496f08], eax
mov eax, dword [0x496f08]
cmp eax, ebx
je 0x423041
cmp dword [0x496f0c], ebx
je 0x423041
push eax
call fcn.004169e9
push dword [0x496f0c]
mov esi, eax
call fcn.004169e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423041
test edi, edi
je 0x423041
call esi
test eax, eax
je 0x423038
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423038
test byte [ebp - 0xc], 1
jne 0x423041
or dword [ebp + 0x10], 0x200000
jmp 0x42307a
mov eax, dword [0x496f00]
cmp eax, ebx
je 0x42307a
push eax
call fcn.004169e9
pop ecx
test eax, eax
je 0x42307a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42307a
mov eax, dword [0x496f04]
cmp eax, ebx
je 0x42307a
push eax
call fcn.004169e9
pop ecx
test eax, eax
je 0x42307a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x496efc]
call fcn.004169e9
pop ecx
test eax, eax
je 0x42309a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42309c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x429aae
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0x620cd11c
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0x68dc4393
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0xf25397
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0xf480db02
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0xab9178be
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc
Function at 0x452574
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x694
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x6ac]
push esi
mov esi, dword [esp + 0x6a4]
mov edx, dword [esi + 4]
push edi
xor eax, eax
push ebx
mov word [esp + 0x50], ax
mov eax, dword [esi]
push edx
xor ecx, ecx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x262], cx
mov dword [esp + 0x488], ebx
mov dword [esp + 0x2c], 1
call fcn.0041557c
mov edx, dword [esp + 0x6b8]
add esp, 0xc
lea ecx, [esp + 0x490]
push ecx
push edx
push esi
call fcn.004523ce
test eax, eax
je 0x45260c
lea eax, [ebx + 6]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x1f]
push 1
push ecx
call fcn.004151b0
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.004151b0
mov ecx, dword [esi]
mov edi, dword [esp + 0x38]
push ecx
push 1
lea edx, [esp + 0x40]
push 4
push edx
xor edi, 0x87bc
call fcn.004151b0
mov ecx, dword [esi]
mov eax, dword [esp + 0x48]
push ecx
push 1
lea edx, [esp + 0x50]
xor eax, 0x87bc
push 4
push edx
mov dword [ebp], eax
call fcn.004151b0
mov eax, dword [esp + 0x58]
add esp, 0x40
xor eax, 0xa685
push 1
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x10
push eax
call fcn.0041557c
mov ecx, dword [ebp]
add esp, 0xc
push ecx
call fcn.004138ba
add esp, 4
push edi
mov dword [esp + 0x20], eax
call fcn.004138ba
mov edx, dword [esi]
add esp, 4
push edx
push 1
mov ebp, eax
push edi
push ebp
call fcn.004151b0
mov eax, dword [esi + 8]
add esp, 0x10
add eax, 0xb02538d4
push eax
push edi
push ebp
call fcn.0044afdc
push edi
push ebp
lea ecx, [esp + 0x28]
push ecx
call fcn.0043535d
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x20]
je 0x4526fd
mov eax, dword [esp + 0x1c]
push eax
call fcn.00413a88
add esp, 4
push ebp
call fcn.00413a88
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
cmp byte [esp + 0x17], 1
jne 0x45275b
xor ecx, ecx
mov eax, 1
mov word [esp + 0x4c], cx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
xor edx, edx
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0x25a], dx
mov dword [esp + 0x480], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], eax
call fcn.0044b195
push ebp
call fcn.00413a88
jmp 0x452769
mov edx, dword [esp + 0x1c]
push edx
call fcn.00413a88
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x6b4]
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [eax], ecx
xor eax, eax
pop ebx
add esp, 0x694
ret 0x10
Function at 0x10007950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x10007982
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10007970
pop edi
mov eax, edx
pop esi
pop ebp
ret

Function at 0x100135d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x1001362d
mov bl, byte [ebp + 8]
cmp byte [esi + 0x10], bl
je 0x10013625
lea ecx, [ebp + 8]
push ecx
push 0x40
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
push ecx
test bl, bl
je 0x10013604
push dword [esi + 4]
jmp 0x10013607
push dword [esi + 8]
push eax
call fcn.10018490
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [esi + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 0x10], bl
pop esi
mov al, bl
pop ebx
pop ebp
ret 4
push str.GW::MemoryPatcher::TogglePatch
push 0x48
push str.C:Users_frencDesktopcustomtbGWToolboxppDependenciesGWCASourceMemoryPatcher.cpp
push str.m_addr___nullptr
call fcn.1000ef50
int3

Function at 0x10013910
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul esi, dword [ebp + 8], 0x2c
push edi
add esi, dword [0x10078070]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp + 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10013958
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1001397d
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1001399e
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1001399e
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10013998
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1001399e
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
shl bl, 2
add cl, cl
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
xor eax, eax
mov byte [esi + 0x14], bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret