joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002870
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x10008328]
push 0
push eax
push 0x10002850
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1000832c], eax
mov eax, 1
ret
Function at 0x10002be0
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
sub esp, 0x924
lea eax, [esp + 0x124]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push 0x800
push eax
push 0
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x12c]
push ecx
push edx
call fcn.100026f0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 8
lea eax, [esp + 0x14]
push str.explorer.exe
push eax
call esi
test eax, eax
jne 0x10002d2b
call sym.PDLL.dll_Hookon
mov ecx, dword [str.wmgjqwerty]
mov edx, dword [0x100054f0]
mov ax, word [0x100054f4]
mov dword [esp + 8], ecx
mov cl, byte [0x100054f6]
mov dword [esp + 0xc], edx
mov word [esp + 0x10], ax
mov byte [esp + 0x12], cl
call fcn.10002840
push str.cwmgjasdfgh
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call fcn.10002840
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10002c94
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
add esp, 0x924
ret
push edi
call fcn.10002840
lea edx, [esp + 0xc]
push edx
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
mov esi, eax
push 0
push 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
call fcn.10002840
mov ecx, dword [0x10008334]
lea eax, [esp + 0x2c]
push 0x104
push eax
push ecx
call ebx
call fcn.10002840
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.10002840
mov ecx, dword [edi]
push 0
push 0
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.10002840
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call fcn.10002840
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x924
ret
lea edx, [esp + 0x14]
push str.elementclient.exe
push edx
call esi
test eax, eax
jne 0x10002d5f
call fcn.10002840
lea eax, [esp + 0x12c]
push 0x10007328
push eax
call fcn.10002730
add esp, 8
call fcn.10002840
call fcn.100028a0
pop esi
pop ebx
add esp, 0x924
ret
Function at 0x100015d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x10135400]
fld qword [eax]
push esi
fsub qword [0x10017d40]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x10135404]
lea ecx, [esp + 0xc]
fabs
push ecx
fstp qword [esp + 0x14]
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
fmul qword [0x10017d38]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push edx
fadd qword [0x10017d30]
push eax
push 8
push edi
fstp qword [edi]
call esi
mov ecx, dword [0x10135400]
fld qword [ecx]
mov edi, dword [0x10135408]
fsub qword [0x10017d40]
lea edx, [esp + 0xc]
push edx
push 0x40
push 8
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
fmul qword [0x10017d38]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
fadd qword [0x10017d30]
push ecx
push 8
push edi
fstp qword [edi]
call esi
mov edx, dword [0x10135400]
fld qword [edx]
mov edi, dword [0x1013540c]
fsub qword [0x10017d40]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea ecx, [esp + 0xc]
fmul qword [0x10017d38]
push ecx
push edx
push 4
fadd qword [0x10017d28]
push edi
fstp dword [edi]
call esi
mov eax, dword [0x10135400]
fld qword [eax]
mov edi, dword [0x10135410]
fsub qword [0x10017d40]
lea ecx, [esp + 0xc]
fabs
fstp qword [esp + 0x10]
push ecx
push 0x40
push 4
push edi
call esi
fld qword [esp + 0x10]
mov eax, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea edx, [esp + 0xc]
fmul qword [0x10017d38]
push edx
push eax
push 4
fadd qword [0x10017d28]
push edi
fstp dword [edi]
call esi
mov ecx, dword [0x10135400]
fld qword [ecx]
mov edi, dword [0x10135414]
fsub qword [0x10017d40]
lea edx, [esp + 0xc]
push edx
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov ecx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea eax, [esp + 0xc]
fmul qword [0x10017d38]
push eax
push ecx
push 4
fadd qword [0x10017d20]
push edi
fstp dword [edi]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [0x10135418], 0
push esi
push edi
je 0x10001937
mov edi, dword [0x101353f4]
fld dword [0x1013541c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10135420]
mov edi, dword [0x101353f8]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10135424]
mov edi, dword [0x101353fc]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld qword [0x10135428]
mov edi, dword [0x10135400]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x10135430]
mov edi, dword [0x10135404]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x10135438]
mov edi, dword [0x10135408]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld dword [0x10135440]
mov edi, dword [0x1013540c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10135444]
mov edi, dword [0x10135410]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10135448]
mov edi, dword [0x10135414]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
push 1
push 3
call fcn.10003160
push eax
mov eax, 0x597630
call eax
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100019f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001a00
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10001a0c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001a16
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001a20
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10001a2a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001a34
or eax, 4
shr ecx, 1
test cl, 1
je 0x10001a3e
or eax, 2
test cl, 2
je 0x10001a46
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001b00
test al, 1
je 0x10001b0d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001b00
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x100019f4
pop edi
pop ebx
ret

Function at 0x10001b30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x100172b8
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001b62
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001b90
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001bf3
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10001bd9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001bb8
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001bb0
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10003680
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a4546], 0
je 0x100037d2
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x80f270
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x80f270], 0xc3
mov edx, dword [ebp - 4]
push edx
push 1
push 0x80f270
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x7f
push 0x895b8d
call esi
push 0x7f
push 0x90
push 0x895b8d
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x7f
push 0x895b8d
call esi
push 0x100037e0
push 0x80eef0
mov bl, 0xe9
call fcn.10014010
push 0x10003a20
push 0x8118c0
call fcn.10014010
push 0x100040c0
push 0x80f8e0
call fcn.10014010
push 0x10004420
push 0x80fa10
call fcn.10014010
push 0x10004890
push 0x810420
call fcn.10014010
push 0x10004a50
push 0x810150
call fcn.10014010
push 0x10004c10
push 0x810700
call fcn.10014010
push 0x10005000
push 0x813740
call fcn.10014010
add esp, 0x40
push 0x100050c0
push 0x813970
call fcn.10014010
push 0x10005450
push 0x8126c0
call fcn.10014010
push 0x10005a70
push 0x895a73
mov bl, 0xe8
call fcn.10014010
push 0x10005ab0
push 0x895ae8
call fcn.10014010
push 0x10005af0
push 0x895b5d
call fcn.10014010
push 0x10005b30
push 0x814e63
call fcn.10014010
add esp, 0x30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.100060c0
test eax, eax
je 0x10006226
push ebx
push esi
push 0x10006410
push 0x4d2882
mov bl, 0xe8
call fcn.10014010
push 0x10006390
push 0x4d28eb
call fcn.10014010
push 0x100063d0
push 0x4d2957
call fcn.10014010
push 0x10006410
push 0x4d29c1
call fcn.10014010
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2887
call esi
mov bl, 0x90
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d2887], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d28f0
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d28f0], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d295c
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d295c], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d29c6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d29c6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d29c6
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100071e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.100070f0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 4
test al, al
je 0x10007220
xor ecx, ecx
test edi, edi
jle 0x10007220
mov dl, byte [0x101331c1]
mov al, dl
imul byte [0x101331c0]
push ebx
mov bl, byte [ecx + esi]
add bl, al
xor bl, dl
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x10007210
pop ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [0x101331c4]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x10007240
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x14], edi
lea esi, [ecx + 1]
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a43f0]
mov byte [ebp - 1], al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a43f1]
movzx edx, byte [edi + 0x100a4383]
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
mov eax, 0xf0f0f0f1
mul edi
mov edi, dword [ebp - 0xc]
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a43f2]
movzx edx, byte [edi + 0x100a4383]
mov byte [ebp - 5], al
mov byte [ebp - 4], dl
mov bl, byte [esi + 0x100a4383]
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a43f3]
movzx edx, byte [ecx + 0x100a4387]
mov byte [ebp - 6], al
mov al, byte [ebp - 1]
mov byte [ebp - 7], dl
mov dl, bl
sub bl, al
xor dl, al
movzx eax, bl
movzx edi, dl
add di, word [ebp - 0x10]
mov dl, byte [ebp - 3]
xor di, ax
mov al, byte [ebp - 2]
mov bl, al
xor bl, dl
sub al, dl
movzx ebx, bl
add di, bx
movzx edx, al
mov al, byte [ebp - 4]
xor di, dx
mov dl, byte [ebp - 5]
mov bl, al
xor bl, dl
movzx ebx, bl
sub al, dl
mov dl, byte [ebp - 6]
add di, bx
movzx eax, al
xor di, ax
mov al, byte [ebp - 7]
mov bl, dl
xor bl, al
movzx ebx, bl
add di, bx
sub al, dl
add dword [ebp - 0xc], 4
movzx edx, al
xor di, dx
movzx eax, di
mov edi, dword [ebp - 0x14]
add esi, 4
add edi, 4
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp esi, 0x21
jb 0x10007260
mov edx, dword [0xd227b0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax - 0x3c]
mov byte [0x101331c1], cl
lea ecx, [ebp - 0x14]
push ecx
shr eax, 8
sub al, 0x46
push 0x40
mov byte [0x101331c0], al
mov eax, dword [0xd227f8]
push 4
push 0xd227b0
mov dword [0x101331c8], edx
mov dword [0x101331c4], eax
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227b0], 0x10007180
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227b0
call esi
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 4
push 0xd227f8
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227f8], 0x100071e0
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227f8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a940
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf8], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebfe], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee42], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee48], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
mov byte [0x62eeeb], bl
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
mov bl, 0x69
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf7], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee41], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee4], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee4
call esi
push 0x1000ab30
push 0x520ecf
mov bl, 0xe8
call fcn.10014010
push 0x1000ab30
push 0x520f1f
call fcn.10014010
push 0x1000ab30
push 0x63e743
call fcn.10014010
push 0x1000ab30
push 0x640eb2
call fcn.10014010
push 0x1000ab30
push 0x7d2dd9
call fcn.10014010
push 0x1000ab30
push 0x7e6c0f
call fcn.10014010
push 0x1000ab30
push 0x84aef7
call fcn.10014010
push 0x1000ab80
push 0x47fe12
call fcn.10014010
add esp, 0x40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000abe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x64
push 0
push 0x10133818
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x63e7e4
call esi
mov edx, 0x63e7e4
mov ecx, 0x90909090
lea eax, [ebp - 4]
push eax
mov word [edx], cx
mov ecx, dword [ebp - 4]
push ecx
push 2
push edx
call esi
push 0x1000ac80
push 0x62eb26
or bl, 0xff
call fcn.10014010
push 0x1000ac90
push 0x888d5f
mov bl, 0xe8
call fcn.10014010
push 0x1000ad50
push 0x886cd7
or bl, 0xff
call fcn.10014010
push 0x1000ad50
push 0x7d3cbd
or bl, 0xff
call fcn.10014010
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ad80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b85
call esi
mov bl, 0xff
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b85], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b85
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b86
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b86], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b86
call esi
push 0x1000aeb0
push 0x4e199d
mov bl, 0xe8
call fcn.10014010
push 0x1000aeb0
push 0x587049
call fcn.10014010
push 0x1000aeb0
push 0x590ccc
call fcn.10014010
push 0x1000aeb0
push 0x5bbee6
call fcn.10014010
push 0x1000aeb0
push 0x64229d
call fcn.10014010
push 0x1000aeb0
push 0x642d51
call fcn.10014010
push 0x1000aeb0
push 0x643229
call fcn.10014010
push 0x1000aeb0
push 0x65ea86
call fcn.10014010
add esp, 0x40
push 0x1000aeb0
push 0x911a53
call fcn.10014010
push 0x1000aeb0
push 0x911a6d
call fcn.10014010
push 0x1000aeb0
push 0x911a87
call fcn.10014010
push 0x1000aeb0
push 0x911aa1
call fcn.10014010
push 0x1000aeb0
push 0x911abb
call fcn.10014010
add esp, 0x28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000cef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
fld dword [0x1013546c]
sub esp, 0x10
call fcn.10015bd0
fld dword [0x10135470]
push 0xa
add eax, 0x14
push 0xa
push eax
call fcn.10015bd0
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000d008
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000d008
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x10135480], 1
je 0x1000cfb5
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x10], 0x90909090
mov dword [ebp - 0xc], 0x90909090
mov word [ebp - 8], 0x9090
call esi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, 0x4d9a02
mov dword [eax], edx
mov dx, word [ebp - 8]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 0xa
push 0x4d9a02
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x10], 0x17e8006a
mov dword [ebp - 0xc], 0x8300102e
mov word [ebp - 8], 0x4c4
call esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, 0x4d9a02
mov dword [eax], ecx
mov cx, word [ebp - 8]
mov dword [eax + 4], edx
lea edx, [ebp - 4]
push edx
mov word [eax + 8], cx
mov eax, dword [ebp - 4]
push eax
push 0xa
push 0x4d9a02
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret