joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eac0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x45eb24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
mov eax, dword [0x45eb6c]
add eax, 4
mov dword [ebp - 0x220], ecx
imul eax, eax, 0x3e8
push ebx
mov ebx, edx
push esi
push edi
cmp ebx, eax
jge 0x43ecbe
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov esi, edi
call fcn.0043e8f4
and dword [ebp - 0x214], 0
mov dword [ebp - 0x218], eax
test eax, eax
je 0x43eb33
mov ecx, eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x43eb21
sub ecx, edx
sar ecx, 1
lea esi, [ecx + edi]
mov edx, dword [0x465ebc]
test edx, edx
je 0x43eb5c
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x43eb5c
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x214]
jne 0x43eb47
sub ecx, edi
sar ecx, 1
add esi, ecx
add esi, 0x23
cmp esi, 0x100
jae 0x43eb6f
lea edi, [ebp - 0x204]
jmp 0x43eb7f
lea ecx, [esi + esi]
call fcn.004524a1
mov edx, dword [0x465ebc]
mov edi, eax
mov dword [ebp - 0x20c], esi
xor esi, esi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x208], esi
test edx, edx
je 0x43ebbd
cmp dword [edx + 8], esi
je 0x43ebbd
mov eax, dword [0x45eb7c]
push dword [eax + 0x20]
lea eax, [ebp - 0x210]
push dword [edx + 8]
push 0x428b6c
push eax
call fcn.0045bb03
add esp, 0x10
jmp 0x43ebd0
lea eax, [ebp - 0x210]
push 0x428b7c
push eax
call fcn.0045bb03
pop ecx
pop ecx
cmp ebx, 0xfa0
jl 0x43ebdf
mov eax, 0x428b88
jmp 0x43ebf1
mov eax, 0x428b98
cmp ebx, 0x7d0
jl 0x43ebf1
mov eax, 0x428bb0
push dword [ebp - 0x218]
push ebx
push eax
lea eax, [ebp - 0x210]
push 0x428bbc
push eax
call fcn.0045bb03
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x43ec36
cmp dword [ebp - 0x20c], eax
jae 0x43ec22
mov eax, dword [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push 0x428bd8
call fcn.0045bb1a
add esp, 0xc
mov al, byte [0x467306]
test al, al
jne 0x43ec56
push 0x428b68
call fcn.0045bb1a
pop ecx
mov ecx, edi
call fcn.00455f21
mov al, byte [0x467306]
cmp al, 1
jne 0x43ec73
cmp ebx, 0x3ea
je 0x43ec73
mov ecx, dword [ebp - 0x210]
mov edx, edi
sub ecx, edi
sar ecx, 1
call fcn.0044d44b
cmp byte [0x4778cb], 0
je 0x43ecbe
cmp ebx, 0x3ec
jne 0x43ecaf
mov eax, dword [0x467238]
test eax, eax
je 0x43ecaf
mov ecx, dword [0x477684]
test ecx, ecx
je 0x43eca7
call fcn.004463db
mov eax, dword [0x467238]
mov dword [0x477684], esi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
pop ecx
mov edx, dword [ebp - 0x220]
mov ecx, edi
call fcn.0043e943
jmp 0x43ecc0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cac1
leave
ret 8

Function at 0x43effd
Capabilities:
Delete file
Terminate process

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x43f006
sub esi, ecx
mov ecx, edi
sar esi, 1
push esi
call fcn.0043ecd1
cmp edi, 0x7d0
pop edi
pop esi
jl fcn.0043938c
ret
Function at 0x448035
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, dword [0x479000]
test eax, eax
jne 0x448046
mov eax, 0x478f10
sub eax, 0xc
add eax, 0xc
mov dword [0x479000], eax
cmp eax, 0x479000
jb 0x448064
mov ecx, 0x3ef
call fcn.0043ef84
jmp fcn.0043938c
push 0x20
pop ecx
call fcn.004524a1
mov ecx, dword [0x479000]
mov dword [ecx], eax
mov dword [ecx + 4], eax
add eax, 0x20
mov dword [ecx + 8], eax
ret

Function at 0x45b795
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, 0x811c9dc5
xor ecx, ecx
movsx eax, byte [ebp + ecx + 8]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x45b79f
mov eax, edx
xor edx, edx
div dword [0x465648]
mov eax, edx
pop ebp
ret 4
Function at 0x10001150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4c0bc2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x10001050
sub eax, 0x4c0bc7
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4c0bc3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x4c0bc7
call esi
mov eax, 0x4c0bc7
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x4c0bc7
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push 0x40
push 5
push 0x555460
call ebx
mov byte [0x555460], 0xe9
mov eax, 0x100016a0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffaaab9b
mov dword [0x555461], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x555460
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x555465
call ebx
mov eax, 0x555465
mov byte [eax], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 1
push 0x555465
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x4b0f57
call ebx
mov byte [0x4b0f57], 0xe9
mov eax, 0x10001d20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffb4f0a4
mov dword [0x4b0f58], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x4b0f57
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x40b444
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x10001730
sub eax, 0x40b449
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x40b445
call edi
push eax
call esi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x40b449
call ebx
mov eax, 0x40b449
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 2
push 0x40b449
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4ab4d9
call edi
push eax
call esi
mov eax, 0x10001de0
sub eax, 0x4ab4de
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4ab4da
call edi
push eax
call esi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x4ab4de
call ebx
mov eax, 0x4ab4de
mov byte [eax], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 1
push 0x4ab4de
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x4b7b71
call ebx
mov eax, 0x4b7b71
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x4b7b71
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4b7b71
call ebx
mov byte [0x4b7b71], 0xe9
mov eax, 0x10001d90
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffb4848a
mov dword [0x4b7b72], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4b7b71
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4558ec
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x10002110
sub eax, 0x4558f1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4558ed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x4558f1
call esi
mov eax, 0x4558f1
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x4558f1
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002360
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003aa28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 0x2b
push str...Voobly_ModsAOCPatches_v1.6_RCicon.drs
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.100029a0
push 0
push 0x10047f50
push 3
push 0
lea ecx, [ebp - 0x28]
call fcn.10002580
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x100023d6
push 0xffffffffffffffff
push 0
push eax
call fcn.10002870
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], 0xf
cmovae edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp byte [edx], 0
jne 0x100023fc
xor ecx, ecx
jmp 0x1000240a
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002401
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.10002770
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0x10047f54
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.100237de
add esp, 8
test eax, eax
je 0x1000243e
push eax
call fcn.100238b2
add esp, 4
mov bl, 1
jmp 0x10002440
xor bl, bl
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x10002455
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10002bd0
test bl, bl
je 0x100024ca
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 5
push 0x43afa8
call esi
mov byte [0x43afa8], 0xe9
mov eax, 0x100021f0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, 0xffbc5053
mov dword [0x43afa9], eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
push 5
push 0x43afa8
call esi
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x100024af
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10002bd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001ceea
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.Icon_Drs_patch_is_missing_or_path_patch_is_wrong__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.100236fc
int3
Function at 0x100045c0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10004190
test al, al
jne 0x100045e7
push 0x30
push str.Error_wrong_Mod_choice
push str.Error_you_should_select_v1.6_Game_Data__v1.5_RC_will_be_load_instead.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push 0
push 0
push 0x10004480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0
push 0
push 0x10004520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
push 6
call fcn.1001d4de
add esp, 4
test eax, eax
je 0x10004657
mov dword [eax], 0x2ca189e9
mov word [eax + 4], 0x9000
jmp 0x10004659
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 6
push eax
push 0x520e72
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
push 5
call fcn.1001d4de
add esp, 4
test eax, eax
je 0x1000468e
mov dword [eax], 0x3b084be9
mov byte [eax + 4], 0
jmp 0x10004690
xor eax, eax
push 0
push 5
push eax
push 0x43aff0
call esi
push eax
call edi
call fcn.100167f0
call fcn.100090d0
call fcn.1000f480
call fcn.10018be0
call fcn.100080c0
call fcn.10001e80
call fcn.100013e0
call fcn.10002360
call fcn.1000bdb0
call fcn.1000d070
call fcn.10012c80
call fcn.10002170
call fcn.10008340
call fcn.1000d5f0
call fcn.10018640
call fcn.1000b0d0
call fcn.10010220
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x528809
call esi
push eax
call edi
mov eax, 0x100020c0
sub eax, 0x52880e
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x52880a
call esi
push eax
call edi
call fcn.100107b0
call fcn.10016c00
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x52665a
call esi
push eax
call edi
mov eax, 0x10002070
sub eax, 0x52665f
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x52665b
call esi
push eax
call edi
call fcn.10001150
call fcn.10017940
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 7
push 0x40239a
call esi
mov ecx, 0x90909090
mov eax, 0x40239a
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 7
push 0x40239a
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Voobly_ModsAOCPatches_v1.6_RCcopylang.dll
call esi
push str.Voobly_ModsAOCPatches_v1.6_RCupdate.dll
call esi
push str.Voobly_ModsAOCPatches_v1.6_RCEmpireWars.dll
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100047e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
cmp eax, 1
jne 0x100048b4
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push eax
lea eax, [ebp + 0xc]
mov byte [ebp + 0xc], 0xeb
push eax
push 0x50a3e5
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
push 0
push 1
lea eax, [ebp + 0xc]
mov byte [ebp + 0xc], 0xeb
push eax
push 0x4ff1e4
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp + 0xc]
mov byte [ebp + 0xc], 0xeb
push eax
push 0x50a448
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp + 0xc]
mov byte [ebp + 0xc], 0xeb
push eax
push 0x510cb7
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp + 0xc]
mov byte [ebp + 0xc], 0xeb
push eax
push 0x510ace
call edi
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4ff0b6
call esi
mov eax, 0x4ff0b6
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 6
push 0x4ff0b6
call esi
call fcn.100045c0
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x100048c1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10006d3c
cmp byte [ebx + 0x3d], 0
je 0x10006d3c
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10006bf9
xor al, al
jmp 0x10006d3e
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100069d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10006c66
sub eax, 1
je 0x10006c6a
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x10006d24
xor bl, bl
jmp 0x10006d26
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10006c9f
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100243a9
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x10006c5f
cmp byte [ebx + 0x3d], 0
je 0x10006d24
test esi, esi
jne 0x10006c21
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
sub eax, edx
cmp eax, 8
jbe 0x10006d1a
lea esi, [edx + 8]
cmp esi, 0xfffffffe
ja 0x10006d1a
cmp ecx, esi
jae 0x10006d01
push edx
push esi
lea ecx, [ebp - 0x28]
call fcn.100030a0
mov ecx, dword [ebp - 0x14]
test esi, esi
je 0x10006c21
push 0
push 8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.10007420
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x28]
mov byte [eax + esi], 0
jmp 0x10006c1e
test esi, esi
jne 0x10006cdb
cmp ecx, 0x10
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov byte [eax], 0
jmp 0x10006c1e
push str.string_too_long
call fcn.1001e120
mov bl, 1
cmp ecx, 0x10
jb 0x10006d38
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10002bd0
mov al, bl
jmp 0x10006d3e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001ceea
mov esp, ebp
pop ebp
ret
Function at 0x10007610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b226
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1004e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1001cefb
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1001e3d2
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100080c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push 0x40
push 5
push 0x568332
call ebx
mov byte [0x568332], 0xe9
mov eax, 0x10007ee0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffa97cc9
mov dword [0x568333], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x568332
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x568337
call ebx
mov esi, 0x568337
lea eax, [ebp - 0x10]
push eax
mov edi, 0x90909090
mov word [esi], di
push dword [ebp - 0x14]
push 2
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x5683aa
call ebx
mov byte [0x5683aa], 0xe9
mov eax, 0x10007f90
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffa97c51
mov dword [0x5683ab], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x5683aa
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push esi
call ebx
lea eax, [ebp - 0x10]
mov word [esi], di
push eax
push dword [ebp - 0x14]
push 2
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xe9
push eax
push 0x555584
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x10007ea0
sub eax, 0x555589
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x555585
call edi
push eax
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x40b89f
call edi
push eax
call esi
mov eax, 0x10007ec0
sub eax, 0x40b8a4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x40b8a0
call edi
push eax
call esi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 7
push 0x525c12
call ebx
mov eax, 0x525c12
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 7
push 0x525c12
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x525c12
call ebx
mov byte [0x525c12], 0xe9
mov eax, 0x10007de0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffada3e9
mov dword [0x525c13], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x525c12
call ebx
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 2
push eax
push 0x527c4e
call edi
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x45571f
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x10008290
sub eax, 0x455724
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x455720
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x455724
call esi
mov eax, 0x455724
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x455724
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x40d813
call ebx
push eax
call edi
mov eax, 0x100082b0
sub eax, 0x40d818
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x40d814
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x40d818
call esi
mov eax, 0x40d818
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x40d818
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x6063fd
call ebx
push eax
call edi
mov eax, 0x100082f0
sub eax, 0x606402
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x6063fe
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 3
push 0x606402
call esi
mov eax, 0x606402
mov ecx, 0x90909090
mov word [eax], cx
mov byte [eax + 2], cl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 3
push 0x606402
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret