joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4214f0
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x440187
call fcn.00427c0a
lea eax, [ebp - 0x5c]
push eax
mov esi, ecx
call fcn.00405970
and dword [ebp - 4], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jmp 0x42155a
lea esi, [ebp - 0x38]
call fcn.00408b48
cmp dword [eax + 0x18], 8
jb 0x421533
mov eax, dword [eax + 4]
jmp 0x421536
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421552
lea esi, [ebp - 0x38]
call fcn.00408b48
push eax
lea eax, [ebp - 0x5c]
call fcn.004059bf
lea esi, [ebp - 0x38]
call fcn.0042476d
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x38]
call fcn.0040d478
test al, al
jne 0x421520
cmp dword [ebp - 0x44], 0
jne 0x42158d
mov esi, 0x44e
lea edi, [ebp - 0x5c]
call fcn.00405a61
push dword [ebp - 0x5c]
call fcn.0042699b
pop ecx
mov eax, esi
call fcn.00427c8d
ret
mov edi, ebx
call fcn.0040b47e
mov esi, ebx
call fcn.0040b9f5
push ebx
push 0x448254
push 0x448258
lea ecx, [ebp - 0x30]
call fcn.0040ccf2
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
jmp 0x421619
lea esi, [ebp - 0x38]
call fcn.00408b48
cmp dword [eax + 0x18], 8
jb 0x4215de
mov eax, dword [eax + 4]
jmp 0x4215e1
add eax, 4
push eax
push str.___s_
lea ecx, [ebp - 0x78]
call fcn.0040ccf2
pop ecx
pop ecx
push 0xffffffffffffffff
push 0
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0040dbce
push 0
push 1
lea esi, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.0040186b
lea esi, [ebp - 0x38]
call fcn.0042476d
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x38]
call fcn.0040d478
test al, al
jne 0x4215cb
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
call esi
test eax, eax
je 0x421656
push 0x44827c
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x421656
push str.__md1M
lea eax, [ebp - 0x30]
push eax
call fcn.0040d2f7
push 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x60], 0xf
call fcn.00401a35
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x421677
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x78]
push ecx
push eax
call fcn.00421489
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x78]
mov edi, eax
call fcn.00401773
test edi, edi
je 0x42169c
mov esi, ebx
call fcn.0040b9f5
push 0
push 1
lea esi, [ebp - 0x30]
call fcn.0040186b
mov esi, edi
jmp 0x421574
Function at 0x42178c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x451070]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push esi
push edi
push 0x3f
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x4b]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x4c], 0
call fcn.00428f40
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0x4c]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x8c], dl
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x40
jb 0x4217ce
lea eax, [ebp - 0x13c]
call fcn.00423580
lea eax, [ebp - 0x8c]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.004235c4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004235c4
lea edi, [ebp - 0x6c]
call fcn.00423602
lea eax, [ebp - 0x13c]
call fcn.00423580
lea eax, [ebp - 0xcc]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.004235c4
mov eax, edi
push 0x20
push eax
lea eax, [ebp - 0x13c]
call fcn.004235c4
add esp, 0x20
lea edi, [ebp - 0x2c]
call fcn.00423602
mov esi, dword [ebp - 0x140]
push 0x20
mov eax, edi
push eax
call fcn.0040d2b0
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00426962
leave
ret
Function at 0x4233da
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
inc ecx
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x4233e9
push 0x40
pop esi
cmp edx, esi
jae 0x423464
sub esi, edx
lea ecx, [ebp + edx*4 - 0x128]
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov edx, dword [ecx - 0x34]
mov edi, esi
rol edi, 0xf
mov ebx, esi
shr esi, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, esi
mov esi, edx
rol esi, 0xe
mov ebx, edx
ror ebx, 7
xor esi, ebx
shr edx, 3
xor esi, edx
add edi, esi
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x42342a
mov ecx, dword [eax + 0x54]
mov edi, dword [eax + 0x50]
mov ebx, dword [eax + 0x68]
mov esi, dword [eax + 0x60]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x6c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, esi
ror ecx, 0xb
mov edx, esi
rol edx, 7
xor ecx, edx
mov edx, esi
ror edx, 6
xor ecx, edx
mov edx, esi
not edx
and edx, ebx
mov ebx, dword [ebp - 0x10]
and ebx, esi
xor edx, ebx
add ecx, edx
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x446eb0]
mov ebx, edi
add ecx, dword [ebp + edx - 0x120]
mov edx, edi
add ecx, dword [ebp - 4]
ror edx, 0xd
rol ebx, 0xa
xor edx, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add edx, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add esi, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [edx + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jb 0x423495
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 8]
add ecx, edi
mov dword [eax + 0x50], ecx
mov ecx, dword [eax + 0x54]
add ecx, edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [eax + 0x58]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x58], ecx
mov ecx, dword [eax + 0x5c]
add ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x5c], ecx
mov ecx, dword [eax + 0x60]
add ecx, esi
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x64]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], ecx
mov ecx, dword [eax + 0x68]
add ecx, ebx
mov dword [eax + 0x68], ecx
mov ecx, dword [eax + 0x6c]
pop edi
add ecx, edx
pop esi
mov dword [eax + 0x6c], ecx
pop ebx
leave
ret
Function at 0x423745
Capabilities:
Delete registry key

Disassembly:
cmp dword [0x455d88], 0
jne 0x42375d
mov dword [0x455d88], 1
jmp fcn.00424556
ret

Function at 0x42422c
Capabilities:
Delete registry value

Disassembly:
push 0x58
mov eax, 0x44005f
call fcn.00427c0a
mov esi, ecx
lea eax, [ebp - 0x48]
push eax
mov ebx, esi
mov edi, edx
call fcn.0040c4b5
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x34], ebx
je 0x4242f6
cmp edi, ebx
jne 0x42425f
mov edi, 0x445c4e
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x42426b
lea eax, [ebp - 0x44]
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str._s__hs__p
lea ecx, [ebp - 0x2c]
call fcn.0040ccf2
add esp, 0x10
mov byte [ebp - 4], 1
cmp byte [ebp + 8], bl
je 0x4242ce
lea eax, [ebp - 0x64]
push eax
call fcn.0040c030
cmp dword [eax + 0x18], 8
pop ecx
jb 0x4242a3
mov eax, dword [eax + 4]
jmp 0x4242a6
add eax, 4
cmp dword [ebp - 0x14], 8
mov ebx, dword [ebp - 0x28]
jae 0x4242b2
lea ebx, [ebp - 0x28]
mov esi, eax
mov edi, 0x455d90
call fcn.0040cdbc
push 0
push 1
lea esi, [ebp - 0x64]
call fcn.0040186b
xor ebx, ebx
jmp 0x4242eb
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4242da
lea eax, [ebp - 0x28]
push eax
push 0x455d90
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040186b
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.0040186b
call fcn.00427c8d
ret 4

Function at 0x424556
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x451070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, str.Softwareprojonepodlpdebug_async_
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cmp eax, 0xc6
ja 0x4245f6
push ebx
push edi
push esi
mov esi, 0x455d90
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00428f40
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push edi
push 0x446894
push esi
call ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push esi
call ebx
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop edi
pop ebx
call fcn.00423e94
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00426962
leave
ret
Function at 0x4249cc
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x43e89b
call fcn.00427bd4
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.00426a12
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x424a16
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x424a02
mov dword [esi + 0x10], edi
jmp 0x424a18
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x424a0e
push esi
jmp 0x424a0f
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x424a18
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x424a58
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.004010a8
mov eax, edi
jmp 0x424a52
call fcn.00427c79
ret

Function at 0x426962
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x451070]
jne 0x42696c
repz ret
jmp fcn.00427cab

Function at 0x42cf4e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042813f
and dword [ebp - 4], 0
cmp dword [0x454768], 0
mov ebx, eax
jne 0x42cfff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42d0b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42d0b0
push eax
call fcn.004280cd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x454768], eax
call esi
push eax
call fcn.004280cd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45476c], eax
call esi
push eax
call fcn.004280cd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x454770], eax
call esi
push eax
call fcn.004280cd
pop ecx
mov dword [0x454778], eax
test eax, eax
je 0x42cfff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004280cd
pop ecx
mov dword [0x454774], eax
mov eax, dword [0x454774]
cmp eax, ebx
je 0x42d057
cmp dword [0x454778], ebx
je 0x42d057
push eax
call fcn.00428148
push dword [0x454778]
mov esi, eax
call fcn.00428148
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42d057
test edi, edi
je 0x42d057
call esi
test eax, eax
je 0x42d04e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42d04e
test byte [ebp - 0xc], 1
jne 0x42d057
or dword [ebp + 0x10], 0x200000
jmp 0x42d090
mov eax, dword [0x45476c]
cmp eax, ebx
je 0x42d090
push eax
call fcn.00428148
pop ecx
test eax, eax
je 0x42d090
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42d090
mov eax, dword [0x454770]
cmp eax, ebx
je 0x42d090
push eax
call fcn.00428148
pop ecx
test eax, eax
je 0x42d090
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x454768]
call fcn.00428148
pop ecx
test eax, eax
je 0x42d0b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42d0b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432b80
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x454898], eax
je 0x432b9e
mov eax, 0x10dd
jmp 0x432c7f
mov eax, dword [0x4548a8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x432c1c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x432bfa
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x432bfa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00432cf0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0042699b
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x432ba6
mov dword [0x4548a8], 0
call fcn.00432c90
mov ecx, dword [0x4548a4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x432c69
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0042699b
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x432c34
mov dword [0x4548a4], 0
mov dword [0x454898], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4331c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x4331d5
xor eax, eax
jmp 0x43324a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x433202
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x433245
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x433243
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x43323f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x433243
xor eax, eax
jmp 0x43324a
jmp 0x4331f9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4332f0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x45489c], 0
je 0x433309
mov eax, dword [0x45489c]
jmp 0x4333a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x43331b
xor eax, eax
jmp 0x4333a9
push 8
call fcn.00426a12
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x433371
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x43335a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0042699b
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x45489c], eax
mov dword [0x4548a0], 0
mov eax, dword [ebp - 4]
jmp 0x4333a9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x43338b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x43333b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x4548a4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x4548a4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x433ca0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00433eb0
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x45488c], 0
jne 0x433cdd
cmp dword [0x454888], 0
je 0x433cdd
mov eax, dword [0x454888]
mov dword [0x45488c], eax
cmp dword [0x45488c], 0
je 0x433d5a
mov ecx, dword [0x45488c]
cmp dword [ecx + 8], 0
je 0x433d5a
mov edx, dword [0x45488c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x433d5a
mov ecx, dword [0x45488c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x433d5a
mov eax, dword [0x45488c]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x433d29
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x433d30
xor eax, eax
jmp 0x433ea0
mov ecx, dword [0x45488c]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00428f40
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x433ea0
mov edx, dword [0x454888]
mov dword [0x45488c], edx
jmp 0x433d76
mov eax, dword [0x45488c]
mov ecx, dword [eax + 4]
mov dword [0x45488c], ecx
cmp dword [0x45488c], 0
je 0x433db6
cmp dword [0x45488c], 0
je 0x433db4
mov edx, dword [0x45488c]
cmp dword [edx + 8], 0
je 0x433db4
mov eax, dword [0x45488c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x433db4
mov edx, dword [0x45488c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x433db4
jmp 0x433d0e
jmp 0x433d68
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x433de7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00434090
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x433e00
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00433f90
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x433e9e
mov ecx, dword [ebp - 4]
mov dword [0x45488c], ecx
mov edx, dword [0x45488c]
mov dword [edx], 0x52727464
mov eax, dword [0x45488c]
mov dword [eax + 8], 0
mov ecx, dword [0x45488c]
mov edx, dword [0x454888]
mov dword [ecx + 4], edx
mov eax, dword [0x45488c]
mov dword [0x454888], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [0x45488c]
add ecx, 0x48
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x38c
jmp 0x433e69
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x433e8d
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x40], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x433e60
mov ecx, dword [0x45488c]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
jmp 0x433d0e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x433f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00434060
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x434055
mov edx, dword [ebp - 4]
cmp edx, dword [0x451ce0]
jb 0x433fd5
mov eax, dword [ebp - 4]
cmp eax, dword [0x451ce4]
ja 0x433fd5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x433fa5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00428f40
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x433ffb
jmp 0x434055
cmp dword [ebp - 0x10], 0x10000
jne 0x43403e
cmp dword [ebp - 0x14], 0x10000
jb 0x43403e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x434031
mov eax, dword [ebp - 0x24]
jmp 0x434057
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x434050
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00434060
add esp, 4
mov dword [ebp - 4], eax
jmp 0x433fa5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x434090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00434170
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x43415d
mov edx, dword [ebp - 4]
cmp edx, dword [0x451ce0]
jb 0x4340da
mov eax, dword [ebp - 4]
cmp eax, dword [0x451ce4]
ja 0x4340da
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x4340aa
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00428f40
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x434100
jmp 0x43415d
cmp dword [ebp - 0x10], 0x10000
jne 0x434143
cmp dword [ebp - 0x14], 0x10000
jb 0x434143
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x434136
mov eax, dword [ebp - 0x24]
jmp 0x43415f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x434158
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00434170
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4340aa
xor eax, eax
mov esp, ebp
pop ebp
ret