joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41722f
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x234
mov eax, 0x49f39e
call fcn.0047b15e
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x23c], ebx
call fcn.0047a8e0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x240], 0x208
mov byte [ebp - 0x235], bl
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
mov dword [ebp - 4], ebx
call fcn.00417379
lea ecx, [ebp - 0x234]
test al, al
je 0x4172a6
push str.SOFTWAREWow6432Node_baiduBaiduBrowser
jmp 0x4172ab
push str.SOFTWARE_baiduBaiduBrowser
call fcn.004073ca
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x4172c5
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x23c]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call dword [0x4a6014]
test eax, eax
jne 0x417347
cmp dword [ebp - 0x23c], ebx
je 0x41735b
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push str.installDir
push dword [ebp - 0x23c]
call dword [section..rdata]
test eax, eax
jne 0x417347
push str._baidubrowser.exe
lea eax, [ebp - 0x218]
push eax
call dword [0x4a62d0]
lea eax, [ebp - 0x218]
push eax
call dword [0x4a62d4]
test eax, eax
je 0x417347
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004073ca
mov byte [ebp - 0x235], 1
cmp dword [ebp - 0x23c], ebx
je 0x41735b
push dword [ebp - 0x23c]
call dword [0x4a6020]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x234]
call fcn.004018e2
mov al, byte [ebp - 0x235]
call fcn.0047b1e1
ret

Function at 0x417379
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 0x24]
push eax
xor bl, bl
call dword [0x4a6224]
cmp word [ebp - 0x24], 9
je 0x41739a
cmp word [ebp - 0x24], 6
jne 0x41739c
mov bl, 1
mov al, bl
pop ebx
leave
ret

Function at 0x4173d5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x49f294
call fcn.0047b15e
mov eax, dword [ebp + 8]
and dword [ebp - 0x220], 0
mov edi, dword [eax]
mov ebx, ecx
mov dword [ebp - 0x21c], ebx
mov esi, edx
test edi, edi
jne 0x41741c
push 0x4b2cb8
call fcn.00407327
and dword [ebp - 4], edi
mov dword [ebp - 0x220], 1
mov eax, ebx
jmp 0x4174a2
mov eax, 0x206
push eax
xor ecx, ecx
mov dword [ebp - 0x224], eax
xor ebx, ebx
push ecx
lea eax, [ebp - 0x216]
inc ebx
push eax
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x218], cx
call fcn.0047a8e0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x417454
mov eax, dword [esi]
jmp 0x417456
mov eax, esi
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x228]
push ecx
xor esi, esi
push esi
push eax
push edi
call dword [section..rdata]
mov ecx, dword [ebp - 0x21c]
test eax, eax
jne 0x417489
lea eax, [ebp - 0x218]
push eax
jmp 0x41748e
push 0x4b2cb8
call fcn.00407327
mov dword [ebp - 4], esi
mov dword [ebp - 0x220], ebx
mov eax, dword [ebp - 0x21c]
call fcn.0047b1e1
ret 4
Function at 0x418e96
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x49ebe1
call fcn.0047b15e
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x418f8a
cmp byte [esi + 0x49], bl
je 0x418f8a
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x418ecb
xor al, al
jmp 0x418f8c
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00418ff4
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x418f2d
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x418f32
dec eax
je 0x418f36
dec eax
dec eax
je 0x418f86
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040193f
mov al, bl
jmp 0x418f8c
mov edx, dword [ebp - 0x2c]
jmp 0x418ef4
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x418f42
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x418f68
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x418f55
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.0047cc79
add esp, 0x10
cmp edi, eax
jne 0x418f17
cmp byte [esi + 0x49], 0
je 0x418f86
test edi, edi
jne 0x418ee6
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004108fb
jmp 0x418ee6
mov bl, 1
jmp 0x418f19
mov al, 1
call fcn.0047b1e1
ret

Function at 0x427bfa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4cff2c], 0
push esi
push edi
jne 0x427b70
call fcn.00427adc
test eax, eax
je 0x427bb5
mov eax, dword [0x4cff2c]
cmp eax, 1
jne 0x427b91
push 0xd
push 0
call dword [0x4a61c4]
push eax
call dword [0x4a61c8]
test eax, eax
je 0x427bb5
jmp 0x427bf7
mov edi, dword [0x4a6234]
push eax
call edi
test eax, eax
jne 0x427bf7
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [0x4a6238]
mov esi, eax
test esi, esi
jne 0x427bb9
xor eax, eax
jmp 0x427bf7
mov eax, dword [esi]
push dword [0x4cff2c]
call edi
mov edi, eax
test edi, edi
je 0x427bdb
push 0x8000
push 0
push esi
call dword [0x4a623c]
mov eax, edi
jmp 0x427bf7
lea edi, [esi + 0xff0]
push esi
push dword [0x4cff2c]
call dword [0x4a6244]
add esi, 0x10
cmp esi, edi
jb 0x427be1
mov eax, esi
pop edi
pop esi
ret
jmp 0x427b5c

Function at 0x42d210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, edx
push esi
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d220
sub eax, esi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x42d244
movsx esi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, esi
cmp edx, eax
jne 0x42d234
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.0047d559
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
pop esi
mov eax, edx
jns 0x42d270
add eax, 0x7fffffff
pop ebp
ret 4
Function at 0x437230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a226
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x4c4cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1c], bl
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0x20], bl
push 0x14
mov byte [ebp - 4], 1
mov dword [esi + 0x4c], ebx
call fcn.00478da8
add esp, 4
cmp eax, ebx
je 0x4372e4
mov dword [esi + 0x48], eax
mov dword [eax], eax
mov eax, dword [esi + 0x48]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x48]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x48]
mov byte [eax + 0x10], 1
mov ecx, dword [esi + 0x48]
mov byte [ecx + 0x11], 1
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], 0xf
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], ebx
call fcn.00478bf4
push 0x4be358
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.0047a95a
int3
Function at 0x438740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x43876f
cmp ecx, eax
jne 0x43876f
mov ecx, ebx
call fcn.004378c0
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x43884d
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438785
sub eax, edi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x4387b0
lea esp, [esp]
movsx edi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, edi
cmp edx, eax
jne 0x4387a0
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.0047d559
imul edx, edx, 0x41a7
imul eax, eax, 0xb14
add esp, 8
sub edx, eax
jns 0x4387da
add edx, 0x7fffffff
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edx
cmp dword [ebx + 0x24], eax
ja 0x4387ef
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x438818
cmp dword [ecx], esi
jne 0x438810
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x438820
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x438820
cmp dword [ecx], esi
jne 0x438820
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x438840
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
push esi
mov dword [edx + 4], eax
call fcn.00478b41
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x438778
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4553e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c293
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c4cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
call fcn.00478da8
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x455465
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
call fcn.0044fbb0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov eax, 0x4c437c
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x456170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c258
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c4cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::FileDescriptorProto.0
call fcn.0044fbb0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, 0x4c437c
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x80], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x84], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4565f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c258
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c4cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.0044fbb0
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 8], 0x4c437c
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4585f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c258
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c4cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.0044fbb0
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, 0x4c437c
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x459180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c293
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c4cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x48
call fcn.00478da8
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x459213
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.0044fbb0
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, 0x4c437c
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478b4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c4cc0]
jne 0x478b56
repz ret
jmp fcn.0047e45c

Function at 0x48e011
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c4cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00481573
and dword [ebp - 0x14], 0
cmp dword [0x4d10a4], 0
mov dword [ebp - 0x18], eax
jne 0x48e0c4
push str.USER32.DLL
call dword [0x4a6098]
mov ebx, eax
test ebx, ebx
je 0x48e16c
mov edi, dword [0x4a6064]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48e16c
mov esi, dword [0x4a6190]
push eax
call esi
push 0x4af4cc
push ebx
mov dword [0x4d10a4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4d10a8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4d10ac], eax
call edi
push eax
call esi
mov dword [0x4d10b4], eax
test eax, eax
je 0x48e0c4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4d10b0], eax
mov eax, dword [0x4d10b0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x4a6194]
cmp eax, ecx
je 0x48e11d
cmp dword [0x4d10b4], ecx
je 0x48e11d
push eax
call esi
push dword [0x4d10b4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48e11d
test ebx, ebx
je 0x48e11d
call edi
test eax, eax
je 0x48e114
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48e114
test byte [ebp - 8], 1
jne 0x48e11d
or dword [ebp + 0x10], 0x200000
jmp 0x48e150
mov eax, dword [0x4d10a8]
cmp eax, dword [ebp - 0x18]
je 0x48e150
push eax
call esi
test eax, eax
je 0x48e150
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48e150
mov eax, dword [0x4d10ac]
cmp eax, dword [ebp - 0x18]
je 0x48e150
push eax
call esi
test eax, eax
je 0x48e150
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4d10a4]
call esi
test eax, eax
je 0x48e16c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48e16e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00478b4c
leave
ret

Function at 0x495de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4d10c8]
mov dword [ebp - 4], eax
jmp 0x495df9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x495e16
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [0x4a6088]
jmp 0x495df0
mov esp, ebp
pop ebp
ret
Function at 0x495e20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [0x4a61ec]
cmp dword [0x4d10d8], eax
je 0x495e3e
mov eax, 0x10dd
jmp 0x495f1f
mov eax, dword [0x4d10e8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x495ebc
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [0x4a6088]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x495e9a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x495e9a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00495f90
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00478b41
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x495e46
mov dword [0x4d10e8], 0
call fcn.00495f30
mov ecx, dword [0x4d10e4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x495f09
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [0x4a6154]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00478b41
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x495ed4
mov dword [0x4d10e4], 0
mov dword [0x4d10d8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x496490
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x4964a5
xor eax, eax
jmp 0x49651a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x4964d2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x496515
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x496513
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x49650f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x496513
xor eax, eax
jmp 0x49651a
jmp 0x4964c9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4965c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4d10dc], 0
je 0x4965d9
mov eax, dword [0x4d10dc]
jmp 0x496679
call dword [0x4a608c]
cmp dword [ebp + 8], eax
jne 0x4965eb
xor eax, eax
jmp 0x496679
push 8
call fcn.00478da8
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x496641
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x49662a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00478b41
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x4d10dc], eax
mov dword [0x4d10e0], 0
mov eax, dword [ebp - 4]
jmp 0x496679
mov ecx, dword [ebp + 8]
push ecx
call dword [0x4a61a8]
cmp eax, 0xffffffff
jne 0x49665b
call dword [0x4a6070]
mov dword [ebp - 4], eax
jmp 0x49660b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x4d10e4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x4d10e4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x496ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00496f70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x496f5c
cmp dword [ebp - 4], 0x50000000
jb 0x496edc
cmp dword [ebp - 4], 0x80000000
ja 0x496edc
mov dword [ebp - 4], 0x80010000
jmp 0x496eb5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0047a8e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x4a6054]
test eax, eax
jne 0x496f02
jmp 0x496f5c
cmp dword [ebp - 0x10], 0x10000
jne 0x496f45
cmp dword [ebp - 0x14], 0x10000
jb 0x496f45
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [0x4a6238]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x496f38
mov eax, dword [ebp - 0x24]
jmp 0x496f5e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x496f57
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00496f70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x496eb5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x496fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00497070
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x497064
cmp dword [ebp - 4], 0x50000000
jb 0x496fe1
cmp dword [ebp - 4], 0x80000000
ja 0x496fe1
mov dword [ebp - 4], 0x4fff0000
jmp 0x496fba
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0047a8e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x4a6054]
test eax, eax
jne 0x497007
jmp 0x497064
cmp dword [ebp - 0x10], 0x10000
jne 0x49704a
cmp dword [ebp - 0x14], 0x10000
jb 0x49704a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [0x4a6238]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x49703d
mov eax, dword [ebp - 0x24]
jmp 0x497066
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x49705f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00497070
add esp, 4
mov dword [ebp - 4], eax
jmp 0x496fba
xor eax, eax
mov esp, ebp
pop ebp
ret