joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000af20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x1000af57
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x1000af44
push eax
push 0x3e
call fcn.100400ff
add esp, 8
jmp 0x1000af57
push 1
lea ecx, [edi + 0xd0]
call fcn.1000b270
mov word [eax - 1], 0x3e
cmp dword [edi + 0x48], 0
jge 0x1000af9a
cmp byte [edi + 0x3c], 0
jne 0x1000af9a
cmp byte [edi + 0x4d], 0
jne 0x1000af9a
mov eax, dword [edi + 0x40]
test eax, eax
je 0x1000af7d
push eax
push 0xa
call fcn.100400ff
add esp, 8
jmp 0x1000af90
push 1
lea ecx, [edi + 0xd0]
call fcn.1000b270
mov word [eax - 1], 0xa
push dword [edi + 0x44]
mov ecx, edi
call fcn.1000a4a0
mov eax, dword [edi + 0x40]
mov byte [edi + 0x3c], 0
test eax, eax
je 0x1000afb9
push eax
push 2
push 1
push 0x10062db0
call fcn.100437e0
add esp, 0x10
jmp 0x1000afd5
push 2
lea ecx, [edi + 0xd0]
call fcn.1000b270
mov cx, word [0x10062db0]
mov word [eax - 1], cx
mov byte [eax + 1], 0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, ecx
lea edx, [ebx + 1]
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x1000afe0
mov eax, dword [edi + 0x40]
sub ebx, edx
test eax, eax
je 0x1000afff
push eax
push ebx
push 1
push ecx
call fcn.100437e0
add esp, 0x10
jmp 0x1000b021
push esi
push ebx
lea ecx, [edi + 0xd0]
call fcn.1000b270
push ebx
push dword [ebp + 8]
lea esi, [eax - 1]
push esi
call fcn.1003f600
add esp, 0xc
mov byte [ebx + esi], 0
pop esi
mov eax, dword [edi + 0x40]
pop ebx
test eax, eax
je 0x1000b039
push eax
push 0x3e
call fcn.100400ff
add esp, 8
pop edi
pop ebp
ret 4
push 1
lea ecx, [edi + 0xd0]
call fcn.1000b270
pop edi
mov word [eax - 1], 0x3e
pop ebp
ret 4

Function at 0x1000b060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x35]
mov byte [ecx + 0x4c], al
cmp byte [edx + 0x34], 0
je 0x1000b0d3
push edi
mov edi, 0x100634f0
lea edx, [edi + 1]
nop dword [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x1000b080
mov eax, dword [ecx + 0x40]
sub edi, edx
test eax, eax
je 0x1000b0a8
push eax
push edi
push 1
push 0x100634f0
call fcn.100437e0
add esp, 0x10
mov al, 1
pop edi
pop ebp
ret 4
push esi
push edi
add ecx, 0xd0
call fcn.1000b270
push edi
push 0x100634f0
lea esi, [eax - 1]
push esi
call fcn.1003f600
add esp, 0xc
mov byte [edi + esi], 0
mov al, 1
pop esi
pop edi
pop ebp
ret 4
mov al, 1
pop ebp
ret 4
Function at 0x1000c160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x1000c189
mov byte [ebp - 8], 0
jmp 0x1000c1a9
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.1003f600
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x1000c1d3
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000c1e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x1000c207
xor bl, bl
jmp 0x1000c22c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.1003f600
add esp, 0xc
test bl, bl
je 0x1000c255
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x1000c2aa
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp bl, 0xe8
jb 0x1000c348
cmp bl, 0xe9
jbe 0x1000c327
cmp bl, 0xff
jne 0x1000c348
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.10037a30
add esp, 4
cmp al, 0x15
je 0x1000c2da
cmp al, 0x25
jne 0x1000c348
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 2
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call ebx
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x1000c31a
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
inc esi
mov dword [eax], esi
call fcn.10037980
add eax, 4
add esp, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c360
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.1000c260
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe9
cmp byte [ebp - 0xc], 0
je 0x1000c3bc
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1000c3fe
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.1000c260
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
cmp byte [ebp - 0xc], 0
je 0x1000c46c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1000c4ae
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100353d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, str.OtherStuff
mov ecx, 0x1006ad80
push esi
call fcn.10037de0
test al, al
je 0x100355b2
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
mov ecx, 0x1006ad80
push 0xa
push str.OtherStuff
call fcn.10037420
mov eax, dword [0x1025c244]
test al, 1
jne 0x10035445
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
mov esi, 0x582029
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0xc
cmp byte [ebp - 8], 0
je 0x1003548c
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 1
push 1
sub esp, 0xc
mov eax, 0x582300
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
movzx ecx, al
mov edx, 0xb
push 0
mov dword [0x100ec940], ecx
call fcn.100386b0
push 0x1006534c
push str._MTIME
movzx eax, byte [0x100ec940]
push str._AAT
push str._FAT
push str._CCT
push str._SBT
push str.RCHAT
push str.HCCLR
push str.CMBCLR
push str.MSCCLR
push str.SBCLR
push 0x10063800
push str.MISC
push 0
push eax
mov eax, 0x581e00
call eax
add esp, 0x64
mov ecx, 0xc9bee4
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov eax, 0x66666667
mov ecx, esi
shr ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov eax, 0x582050
mov word [0x1017ca00], dx
call eax
add esp, 0xc
mov eax, dword [0xb7cb84]
mov byte [0x1006c842], 0xff
mov dword [0x1025b6c8], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100355d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, str.OtherStuff_2
mov ecx, 0x1006ad80
push esi
call fcn.10037de0
test al, al
je 0x100357b2
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
mov ecx, 0x1006ad80
push 0xc
push str.OtherStuff_2
call fcn.10037420
mov eax, dword [0x1025c244]
test al, 1
jne 0x10035645
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
mov esi, 0x582029
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0xc
cmp byte [ebp - 8], 0
je 0x1003568c
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 1
push 1
sub esp, 0xc
mov eax, 0x582300
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
movzx ecx, al
mov edx, 0xb
push 0
mov dword [0x100ec940], ecx
call fcn.100386b0
push 0x10065350
push str._ENHELI
movzx eax, byte [0x100ec940]
push str._EHBF
push str._FBDNA
push str._EEL
push str._EBW
push str._DWS
push str._EHSL
push str._EHW
push str._MLTIME
push str._FDTS
push str._CMTIME
push str.MISC
push 0
push eax
mov eax, 0x581e00
call eax
add esp, 0x64
mov ecx, 0xc9bee4
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov eax, 0x66666667
mov ecx, esi
shr ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov eax, 0x582050
mov word [0x1017ca00], dx
call eax
add esp, 0xc
mov eax, dword [0xb7cb84]
mov byte [0x1006c842], 0xff
mov dword [0x1025b6c8], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100357d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, str.OtherStuff_3
mov ecx, 0x1006ad80
push esi
call fcn.10037de0
test al, al
je 0x100359b2
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
mov ecx, 0x1006ad80
push 0xc
push str.OtherStuff_3
call fcn.10037420
mov eax, dword [0x1025c244]
test al, 1
jne 0x10035845
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
mov esi, 0x582029
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0xc
cmp byte [ebp - 8], 0
je 0x1003588c
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 1
push 1
sub esp, 0xc
mov eax, 0x582300
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
movzx ecx, al
mov edx, 0xb
push 0
mov dword [0x100ec940], ecx
call fcn.100386b0
push 0x10065354
push str._MPCOL
movzx eax, byte [0x100ec940]
push str._LTL
push str._SCCL
push str._CCL
push str._DCCL
push str._WCCLEL
push str._KCLEV
push str._EVIGA
push str._EPNS
push str._ERADPC
push str._EEMPS
push str.MISC
push 0
push eax
mov eax, 0x581e00
call eax
add esp, 0x64
mov ecx, 0xc9bee4
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov eax, 0x66666667
mov ecx, esi
shr ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov eax, 0x582050
mov word [0x1017ca00], dx
call eax
add esp, 0xc
mov eax, dword [0xb7cb84]
mov byte [0x1006c842], 0xff
mov dword [0x1025b6c8], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100359d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xb7cb84]
sub esp, 0x14
sub eax, dword [0x1025b6c8]
push esi
cmp eax, 0xc8
jb 0x10035c95
mov edx, str.OtherStuff_4
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x10035c8e
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
mov ecx, 0x1006ad80
push 0xc
push str.OtherStuff_4
call fcn.10037420
mov eax, dword [0x1025c244]
test al, 1
jne 0x10035a5b
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
mov esi, 0x582029
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0xc
cmp byte [ebp - 8], 0
je 0x10035aa2
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 1
push 1
sub esp, 0xc
mov eax, 0x582300
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
movzx ecx, al
xor edx, edx
push 1
mov dword [0x100ec940], ecx
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 1
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 2
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 3
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 4
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 5
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 6
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
add esp, 0x40
mov edx, 7
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 8
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 9
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 0xa
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 0xb
push 0
call fcn.100386b0
push 0x10065358
push str._SBS
movzx eax, byte [0x100ec940]
push str._LTC
push str._TPTP
push str._MPO
push str._HTD
push str._PHS
push str._SSFRAT
push str._BWFR
push str._HWT
push str._BWT
push str._MZL
push str.MISC
push 0
push eax
mov eax, 0x581e00
call eax
add esp, 0x50
mov ecx, 0xc9bee4
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov eax, 0x66666667
mov ecx, esi
shr ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov eax, 0x582050
mov word [0x1017ca00], dx
call eax
add esp, 0xc
mov byte [0x1006c842], 0xff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xb7cb84]
sub esp, 0x14
sub eax, dword [0x1025b6c8]
push esi
cmp eax, 0xc8
jb 0x10035f6f
mov edx, str.OtherStuff_5
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x10035f5e
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
mov ecx, 0x1006ad80
push 0xc
push str.OtherStuff_5
call fcn.10037420
mov eax, dword [0x1025c244]
test al, 1
jne 0x10035d2b
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
mov esi, 0x582029
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0xc
cmp byte [ebp - 8], 0
je 0x10035d72
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 1
push 1
sub esp, 0xc
mov eax, 0x582300
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
movzx ecx, al
xor edx, edx
push 0
mov dword [0x100ec940], ecx
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 1
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 2
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 3
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 4
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 5
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 6
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
add esp, 0x40
mov edx, 7
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 8
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 9
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 0xa
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 0xb
push 0
call fcn.100386b0
push 0x10065374
push str._AHDFP
movzx eax, byte [0x100ec940]
push str._PHDP
push str._HMV
push str._CMBS
push str._MARES
push str._CMSPD
push str._MSPD
push str._MSLF
push str._MSU
push str._MSS
push str._PHES
push str.MISC
push 0
push eax
mov eax, 0x581e00
call eax
add esp, 0x50
mov ecx, 0xc9bee4
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov eax, 0x66666667
mov ecx, esi
shr ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov eax, 0x582050
mov word [0x1017ca00], dx
call eax
add esp, 0xc
mov eax, dword [0xb7cb84]
mov dword [0x1025b6c8], eax
mov byte [0x1006c842], 0xff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035fa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xb7cb84]
sub esp, 0x14
sub eax, dword [0x1025b6c8]
push esi
cmp eax, 0xc8
jb 0x10036227
mov edx, str.OtherStuff_6
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x10036216
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
mov ecx, 0x1006ad80
push 0xc
push str.OtherStuff_6
call fcn.10037420
mov eax, dword [0x1025c244]
test al, 1
jne 0x1003602b
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
mov esi, 0x582029
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 8
cmp byte [ebp - 8], 0
je 0x10036072
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 1
push 1
sub esp, 0xc
mov eax, 0x582300
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
movzx ecx, al
xor edx, edx
push 1
mov dword [0x100ec940], ecx
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 1
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 2
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 3
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 4
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 5
push 0
call fcn.100386b0
mov ecx, dword [0x100ec940]
mov edx, 6
push 1
call fcn.100386b0
mov ecx, dword [0x100ec940]
add esp, 0x40
mov edx, 7
push 0
call fcn.100386b0
push str.DUMMY
push str.DUMMY
movzx eax, byte [0x100ec940]
push str.DUMMY
push str.DUMMY
push 0x100653c0
push str.SWTRAP
push str._EOM
push str._MPS
push str._PSC
push str._FZPOS
push str._FYPOS
push str._DBSTAR
push str.MISC
push 0
push eax
mov eax, 0x581e00
call eax
add esp, 0x40
mov ecx, 0xc9bee4
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov ecx, esi
shr ecx, 1
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov eax, 0x582050
mov word [0x1017ca00], dx
call eax
add esp, 0xc
mov eax, dword [0xb7cb84]
mov dword [0x1025b6c8], eax
mov byte [0x1006c842], 0xff
pop esi
mov esp, ebp
pop ebp
ret