joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10050810
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [0x100cb10c]
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x333cc8]
mov eax, str.LordGaming.Premium
call fcn.10001140
test al, al
je 0x1005088d
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.LordGaming.Premium
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005088d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x333cc4
je 0x100508a4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x333cc4
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10050886
xor eax, eax
lea esp, [esp]
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xda
mov byte [esi + eax], dl
inc eax
cmp eax, 0x333cc4
jb 0x100508d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.10058d40
mov esp, ebp
pop ebp
ret

Function at 0x10050980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x514
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push esi
push edi
mov edi, dword [0x100cb10c]
cmp dword [edi + 0x278], 0
je 0x10050a77
push 0x103
lea eax, [esp + 0x415]
push 0
push eax
mov byte [esp + 0x41c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100509ef
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [edi + 0xd3]
push ebx
lea esi, [esp + 0x414]
call fcn.10056a60
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x10050a18
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [esp + 0x10]
call section..text
mov edx, esi
push edx
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.10001140
test al, al
jne 0x10050a4f
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0x278]
cmp eax, dword [esp + 0xc]
je 0x10050a77
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x10050a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100cb10c]
cmp dword [ebx + 0x27c], 0
push esi
push edi
je 0x10050baa
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0xf3]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10050b17
lea ecx, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x27c]
cmp eax, dword [esp + 0x10]
je 0x10050b58
lea ecx, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10050b98
push edi
lea eax, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Antihack
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005f3d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10050baa
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x10050bc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100cb10c]
cmp dword [ebx + 0x284], 0
push esi
push edi
je 0x10050cda
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x133]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10050c47
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x284]
cmp eax, dword [esp + 0x10]
je 0x10050c88
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10050cc8
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005f3d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10050cda
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x10050cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100cb10c]
cmp dword [ebx + 0x288], 0
push esi
push edi
je 0x10050e0a
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x153]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10050d77
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x288]
cmp eax, dword [esp + 0x10]
je 0x10050db8
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10050df8
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005f3d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10050e0a
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x10050e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100cb10c]
cmp dword [ebx + 0x28c], 0
push esi
push edi
je 0x10050f3a
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x173]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10050ea7
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x28c]
cmp eax, dword [esp + 0x10]
je 0x10050ee8
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10050f28
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005f3d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10050f3a
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x10050f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100cb10c]
cmp dword [ebx + 0x290], 0
push esi
push edi
je 0x1005106a
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x193]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10050fd7
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x290]
cmp eax, dword [esp + 0x10]
je 0x10051018
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10051058
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005f3d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005106a
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x10051080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100cb10c]
cmp dword [ebx + 0x280], 0
push esi
push edi
je 0x1005119a
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x113]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10051107
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x280]
cmp eax, dword [esp + 0x10]
je 0x10051148
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10051188
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005f3d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005119a
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret

Function at 0x100511b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push esi
push edi
mov edi, dword [0x100cb10c]
cmp dword [edi + 0x294], 0
je 0x10051269
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea ebx, [edi + 0x1b3]
push eax
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.10001140
test al, al
jne 0x1005121d
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [edi + 0x294]
cmp ecx, dword [esp + 0xc]
je 0x10051245
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10051257
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005f3d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10051269
call eax
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x100525a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0xe609e8], 5
jne 0x10052651
cmp dword [0x100cff50], 1
jne 0x10052651
push esi
call fcn.10052660
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x100cff5c]
cmp eax, dword [0x100cff64]
jbe 0x10052619
mov dword [0x100cff50], 2
mov dword [0x100cff54], 0
call esi
mov dword [0x100cff58], eax
call esi
mov dword [0x100cff5c], eax
mov dword [0x100cff60], 0
mov dword [0x100cff64], 0
mov eax, 0x63a180
mov ecx, 0x8793750
pop esi
jmp eax
call esi
sub eax, dword [0x100cff58]
cmp eax, dword [0x100cff60]
jb 0x10052650
mov eax, dword [0x100cff54]
sub eax, 0
je 0x10052644
dec eax
jne 0x10052649
call fcn.10052890
call esi
mov dword [0x100cff58], eax
pop esi
ret
call fcn.10052830
call esi
mov dword [0x100cff58], eax
pop esi
ret

Function at 0x10052c30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100cff54], 2
jne 0x10052cab
mov edx, dword [0x100cd070]
mov eax, dword [0x100cd06c]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x100cd074]
lea edx, [ebp - 0x10]
push esi
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.10052330
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
mov dword [0x100cff50], 1
mov dword [0x100cff54], 3
call esi
mov dword [0x100cff58], eax
call esi
mov dword [0x100cff5c], eax
mov eax, 0x7530
mov dword [0x100cff60], eax
mov dword [0x100cff64], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10052cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [0x100cff54], 3
push esi
jne 0x10052ce4
cmp dword [0x100cff6c], ebx
je 0x10052ce4
lea eax, [ebp - 8]
lea ecx, [ebx + 5]
push eax
mov dword [ebp - 8], 0x51bf05c1
mov byte [ebp - 4], bl
call fcn.10052330
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100cff50], ebx
mov dword [0x100cff54], ebx
call esi
mov dword [0x100cff58], eax
call esi
pop esi
mov dword [0x100cff60], ebx
mov dword [0x100cff64], ebx
mov dword [0x100cff68], ebx
mov dword [0x100cff6c], ebx
mov dword [0x100cff5c], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10055f90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x10055fbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 1
push esi
mov byte [esi], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x10055fb3
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10055ff0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x1005601e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x10056013
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10056050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [ebp - 0x10], cl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x10056089
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push esi
mov byte [esi + 4], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x1005607e
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100560c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx esi, si
push edi
push esi
call fcn.10056d67
push esi
mov edi, eax
push 0x90
push edi
call sub.MSVCR100.dll_memset
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10056105
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push esi
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100560fa
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10056140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x1005616e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
fld qword [ebp + 8]
lea ecx, [ebp - 8]
fstp qword [esi]
push ecx
push edx
push 8
push esi
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x10056163
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100561d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [0xe8c578]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10056235
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x10056257
mov ecx, dword [0xe8c578]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov bl, 1
call fcn.10056260
mov edi, dword [0x100cb10c]
add edi, 0x81
call fcn.100563b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0xe8c578]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor bl, bl
call fcn.10056260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10056520
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [0x8128ac8]
sub esp, 0x34
push ebx
push esi
mov dword [0x100cd0f8], eax
mov ecx, dword [0x7bc4f04]
push edi
mov esi, 0x100cd0b8
mov dword [0x100cd0fc], ecx
call fcn.100567f0
mov edx, dword [0x879340c]
mov dword [0x100cd10c], edx
mov eax, dword [0x8793410]
mov dword [0x100cd114], eax
mov ecx, dword [0xe61e18]
mov eax, dword [0x100cd0fc]
mov dword [0x100cd108], ecx
mov edx, dword [eax + 0xac]
mov dword [0x100cd0b8], edx
mov eax, dword [eax + 0xb0]
mov dword [0x100cd0bc], eax
mov eax, dword [0x100cd0f8]
movsx ecx, word [eax + 0xe]
push eax
push 0x1005e2c0
push 0x100cd0c8
mov dword [0x100cd0c0], ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edx, dword [0x7bc4f04]
movzx eax, byte [edx + 0x32]
mov ecx, dword [0x8128ac8]
movzx eax, word [ecx + eax*2 + 0x78]
mov edx, 0x105
add esp, 0xc
cmp ax, dx
je 0x10056613
mov ecx, 0x228
cmp ax, cx
je 0x10056613
mov edx, 0x22b
cmp ax, dx
je 0x10056613
fld qword [0x10060508]
sub esp, 8
mov esi, 0xd27c88
fstp qword [esp]
call fcn.10056140
fld qword [0x10060500]
mov esi, 0xd281c0
fstp qword [esp]
call fcn.10056140
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
fld qword [0x100604f8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x30]
fstp qword [esp + 0x38]
push eax
push 0x40
push 8
xor edi, edi
push 0xd27c88
mov dword [esp + 0x40], edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10056665
fld qword [esp + 0x38]
mov ecx, 0xd27c88
fstp qword [ecx]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x34]
push edx
push eax
push 8
push ecx
mov dword [esp + 0x44], edi
call esi
test eax, eax
jne 0x10056667
call ebx
fld qword [0x100604f0]
lea ecx, [esp + 0x30]
push ecx
fstp qword [esp + 0x3c]
push 0x40
push 8
push 0xd281c0
mov dword [esp + 0x40], edi
call esi
test eax, eax
je 0x100566ab
fld qword [esp + 0x38]
mov edx, 0xd281c0
fstp qword [edx]
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x34]
push eax
push ecx
push 8
push edx
mov dword [esp + 0x44], edi
call esi
test eax, eax
jne 0x100566ad
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10056870
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
mov byte [esi], cl
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100568a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 8]
mov edx, dword [ebp - 4]
fstp dword [esi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push esi
call edi
pop edi
mov esp, ebp
pop ebp
ret