joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119915
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x1013cec8]
call fcn.100513e0
push str.Data__Aox__Lua__CharacterSystem__CharacterCreateCape.lua
mov ecx, 0x1013cec4
call fcn.1003aa40
push dword [0x1013cec8]
call fcn.10016fc0
push dword [0x1013cec8]
call fcn.1003b7e0
mov ecx, dword [0x1013cec8]
call fcn.10053540
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1012f0ec
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10008db0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push dword [0x1013cec8]
lea ecx, [ebp - 0x48]
call fcn.10009070
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.100176e0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x10016e26
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10016e1c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016fb9
push edx
push ecx
call fcn.1008bb02
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x10016e6c
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10016e62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016fb9
push edx
push ecx
call fcn.1008bb02
add esp, 8
push 0x100165a0
push 0x57232e
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016650
push 0x5757d4
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x100166c0
push 0x574667
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016730
push 0x5750fb
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016810
push 0x5fa844
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016970
push 0x5658b6
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016a40
push 0x8362a2
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016a90
push 0x83640e
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016ae0
push 0x57605b
push 0xe9
call fcn.100866a0
add esp, 0xc
push 0x10016b20
push 0x576144
push 0xe9
call fcn.100866a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x51ec76
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x51ec76
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x51ec76
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10016b90
push 0x51ec76
push 0xe9
call fcn.100866a0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret
call fcn.100ee6bd
int3
Function at 0x1001df80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119915
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1012f0ec
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10008db0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push dword [0x1013dd78]
lea ecx, [ebp - 0x48]
call fcn.10009070
push 0x1001dea0
push str.SetJewelStack
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10010f10
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x1001e037
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e02d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e156
push edx
push ecx
call fcn.1008bb02
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x1001e084
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e07a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e156
push edx
push ecx
call fcn.1008bb02
add esp, 8
push str.Data__Aox__Lua__Configs__CustomJewelStack.lua
mov ecx, 0x1013dd74
call fcn.1003aa40
push 0x1012f0a5
push str.StartLoadJewelStack
push 0x1013dd74
call fcn.1003aba0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
push 0x40
push 6
push 0x7dc964
call esi
mov eax, 0x7dc964
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x7dc964
call esi
push 0x1001dd50
push 0x7dc964
push 0xe9
call fcn.100866a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x7dd634
call esi
mov eax, 0x7dd634
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x7dd634
call esi
push 0x1001de70
push 0x7dd634
push 0xe9
call fcn.100866a0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret
call fcn.100ee6bd
int3
Function at 0x1001fbc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 8]
mov byte [0x62ebf8], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 8]
mov byte [0x62ebfe], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea eax, [ebp - 8]
mov byte [0x62ee42], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ee42
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea eax, [ebp - 8]
mov byte [0x62ee48], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ee48
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea eax, [ebp - 8]
mov byte [0x62eee5], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62eee5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 8]
mov byte [0x62eeeb], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 8]
mov byte [0x62ebf7], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea eax, [ebp - 8]
mov byte [0x62ee41], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62ee41
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea eax, [ebp - 8]
mov byte [0x62eee4], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62eee4
call esi
push 0x1001eef0
push 0x4dada4
push 0xe8
call fcn.100866a0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 0x83
push 0x47fc85
call esi
push 0x83
push 0x90
push 0x47fc85
call fcn.100d9980
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x83
push 0x47fc85
call esi
push 0x1001f110
push 0x47fc85
push 0xe9
call fcn.100866a0
push 0x1001fb90
push 0x520ecf
push 0xe8
call fcn.100866a0
push 0x1001fb90
push 0x520f1f
push 0xe8
call fcn.100866a0
push 0x1001fb90
push 0x63e743
push 0xe8
call fcn.100866a0
push 0x1001fb90
push 0x640eb2
push 0xe8
call fcn.100866a0
push 0x1001fb90
push 0x7d2dd9
push 0xe8
call fcn.100866a0
add esp, 0x48
push 0x1001fb90
push 0x7e6c0f
push 0xe8
call fcn.100866a0
push 0x1001fb90
push 0x84aef7
push 0xe8
call fcn.100866a0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.1008b7da
mov esp, ebp
pop ebp
ret
Function at 0x1002d640
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d6d6
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x10143684]
mov dword [0x10143688], eax
test ecx, ecx
je 0x1002d6a2
push ecx
call fcn.1008bef7
mov eax, dword [0x10143688]
add esp, 4
mov dword [0x10143684], 0
push eax
call fcn.1008bb63
add esp, 4
mov dword [0x10143684], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push 0
push ecx
push dword [0x10143688]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x1002d6ea
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov ecx, dword [0x10143688]
cmp ecx, 8
jb 0x1002d6d6
mov esi, dword [0x10143684]
mov eax, dword [esi]
cmp eax, dword [0x1012f048]
jne 0x1002d6d6
mov eax, dword [esi + 4]
cmp eax, dword [0x1012f04c]
jne 0x1002d6d6
push edi
lea eax, [ecx - 8]
xor edi, edi
test eax, eax
jle 0x1002d77f
mov ecx, 0x10149184
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d730
sub ecx, edx
mov eax, edi
xor edx, edx
div ecx
movsx eax, byte [edx + 0x10149184]
and eax, 0xf
movzx eax, byte [eax + 0x1012f038]
sub byte [esi + edi + 8], al
mov eax, edi
mov ecx, dword [0x10143684]
and eax, 0xf
movzx eax, byte [eax + 0x1012f038]
xor byte [ecx + edi + 8], al
inc edi
mov eax, dword [0x10143688]
add eax, 0xfffffff8
cmp edi, eax
jge 0x1002d77f
mov esi, dword [0x10143684]
jmp 0x1002d722
call fcn.100e30de
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push str.Data_t_d
push 0x1014368c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x10106
push 2
push 0
push 7
push 0x40000000
push 0x1014368c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x1002d6d6
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov eax, dword [0x10143688]
add eax, 0xfffffff8
push eax
mov eax, dword [0x10143684]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x1002d80a
call ebx
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 4
call ebx
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 4
Function at 0x100433f0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10043486
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x10149ca4]
mov dword [0x10149ca8], eax
test ecx, ecx
je 0x10043452
push ecx
call fcn.1008bef7
mov eax, dword [0x10149ca8]
add esp, 4
mov dword [0x10149ca4], 0
push eax
call fcn.1008bb63
add esp, 4
mov dword [0x10149ca4], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push 0
push ecx
push dword [0x10149ca8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x1004349a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov ecx, dword [0x10149ca8]
cmp ecx, 8
jb 0x10043486
mov esi, dword [0x10149ca4]
mov eax, dword [esi]
cmp eax, dword [0x1012f064]
jne 0x10043486
mov eax, dword [esi + 4]
cmp eax, dword [0x1012f068]
jne 0x10043486
push edi
lea eax, [ecx - 8]
xor edi, edi
test eax, eax
jle 0x1004352f
mov ecx, 0x10149184
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100434e0
sub ecx, edx
mov eax, edi
xor edx, edx
div ecx
movsx eax, byte [edx + 0x10149184]
and eax, 0xf
movzx eax, byte [eax + 0x1012f054]
sub byte [esi + edi + 8], al
mov eax, edi
mov ecx, dword [0x10149ca4]
and eax, 0xf
movzx eax, byte [eax + 0x1012f054]
xor byte [ecx + edi + 8], al
inc edi
mov eax, dword [0x10149ca8]
add eax, 0xfffffff8
cmp edi, eax
jge 0x1004352f
mov esi, dword [0x10149ca4]
jmp 0x100434d2
call fcn.100e30de
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push 0x10148ced
push str._s_d.lua
push 0x10149cac
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x102
push 2
push 0
push 7
push 0x40000000
push 0x10149cac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x10043486
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov eax, dword [0x10149ca8]
add eax, 0xfffffff8
push eax
mov eax, dword [0x10149ca4]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x100435bf
call ebx
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 4
call ebx
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 4
Function at 0x10043ae0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011ad3d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1013c018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1012f0a5
mov eax, 0x10149cac
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10043b30
test dl, dl
je 0x10043b2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10043b30
add eax, 2
add ecx, 2
test dl, dl
jne 0x10043b10
xor eax, eax
jmp 0x10043b35
sbb eax, eax
or eax, 1
test eax, eax
je 0x10043bfd
push 0x10149cac
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x10043bfd
mov ecx, 0x10148ced
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10043b71
sub ecx, edx
push ecx
push 0x10148ced
lea ecx, [ebp - 0x24]
call fcn.10008db0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.10043a60
mov edx, dword [ebp - 0x10]
cmp edx, 0x10
jb 0x10043bc7
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10043bbd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10043c0c
push edx
push ecx
call fcn.1008bb02
add esp, 8
push dword [0x10149ca4]
call fcn.1008bef7
add esp, 4
mov dword [0x10149ca4], 0
mov dword [0x10149ca8], 0
push 0x100
push 0
push 0x10149cac
call fcn.100d9980
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
call fcn.100ee6bd
int3
Function at 0x1005bdc0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1005be35
sub eax, 1
jne 0x1005be3f
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [ebp + 8]
push eax
push ebx
push 0x10034b80
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x101437a4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x10034d40
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x10034b10
push 0x4d0e2f
push 0xe8
mov dword [0x101437a8], eax
mov dword [0x101437a0], ebx
call fcn.100866a0
add esp, 0xc
mov dword [0x1014c7a4], ebx
mov eax, 1
pop ebx
pop ebp
ret 0xc
mov ecx, 0x1013ce08
call fcn.10007150
mov eax, 1
pop ebp
ret 0xc
Function at 0x10067200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0xe8c588]
push ebx
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push edi
test eax, eax
je 0x10067225
push eax
call esi
mov eax, dword [0xe8c58c]
test eax, eax
je 0x10067231
push eax
call esi
mov eax, dword [0xe8c590]
test eax, eax
je 0x1006723d
push eax
call esi
mov eax, dword [0xe8c594]
test eax, eax
je 0x10067249
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x81c0380
call edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov dword [0x81c0380], esi
push dword [ebp - 8]
push 4
push 0x81c0380
call edi
cmp dword [0x1013d088], 0x10
mov ecx, 0x1013d074
mov edi, dword [sym.imp.GDI32.dll_CreateFontA]
mov ebx, 0x190
cmovae ecx, dword [0x1013d074]
mov eax, 0x2bc
cmp dword [0x1013d068], 1
mov edx, ebx
push ecx
push 0
push 3
push 0
push 0
push dword [0x1013d070]
cmove edx, eax
mov eax, dword [0x1013d06c]
push 0
push 0
push 0
push edx
push 0
push 0
dec eax
add eax, esi
push 0
push eax
call edi
mov dword [0xe8c588], eax
mov ecx, 0x1013d098
cmp dword [0x1013d0ac], 0x10
mov eax, 0x2bc
mov edx, ebx
cmovae ecx, dword [0x1013d098]
cmp dword [0x1013d08c], 1
push ecx
push 0
push 3
push 0
push 0
push dword [0x1013d094]
cmove edx, eax
mov eax, dword [0x1013d090]
push 0
push 0
push 0
push edx
push 0
push 0
dec eax
add eax, esi
push 0
push eax
call edi
mov dword [0xe8c58c], eax
mov ecx, 0x1013d0bc
cmp dword [0x1013d0d0], 0x10
mov eax, 0x2bc
mov edx, ebx
cmovae ecx, dword [0x1013d0bc]
cmp dword [0x1013d0b0], 1
push ecx
cmove edx, eax
mov eax, dword [0x1013d0b4]
push 0
lea eax, [eax + esi*2]
add eax, 0xfffffffe
push 3
push 0
push 0
push dword [0x1013d0b8]
push 0
push 0
push 0
push edx
push 0
push 0
push 0
push eax
call edi
mov dword [0xe8c590], eax
mov ecx, 0x1013d0e0
cmp dword [0x1013d0f4], 0x10
mov eax, 0x2bc
cmovae ecx, dword [0x1013d0e0]
cmp dword [0x1013d0d4], 1
push ecx
push 0
push 3
push 0
push 0
push dword [0x1013d0dc]
cmove ebx, eax
mov eax, dword [0x1013d0d8]
push 0
push 0
push 0
push ebx
push 0
push 0
add eax, 0xc
push 0
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0xe8c594], eax
pop ebx
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 8
Function at 0x10067ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119915
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x78c015
call esi
mov eax, 0x78c015
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x78c015
call esi
push 0x10067ad0
push 0x78c015
push 0xe9
call fcn.100866a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x78a01b
call esi
mov eax, 0x78a01b
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 0xa
push 0x78a01b
call esi
push 0x10067b10
push 0x78a01b
push 0xe9
call fcn.100866a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 7
push 0x6403f5
call esi
mov eax, 0x6403f5
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 7
push 0x6403f5
call esi
push 0x10067860
push 0x6403f5
push 0xe9
call fcn.100866a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 8
push 0x788c59
call esi
mov eax, 0x788c59
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 8
push 0x788c59
call esi
push 0x10067a60
push 0x788c59
push 0xe9
call fcn.100866a0
add esp, 0xc
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
push 2
push 0x1012f0ec
call fcn.10008db0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push dword [0x10149db0]
lea ecx, [ebp - 0x48]
call fcn.10009070
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.10067fa0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x10067e76
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10067e6c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10067eff
push edx
push ecx
call fcn.1008bb02
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x10067ebf
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10067eb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10067eff
push edx
push ecx
call fcn.1008bb02
add esp, 8
push str.Data__Aox__Lua__Configs__MessageColors.lua
mov ecx, 0x10149dac
call fcn.1003aa40
push 0x1012f0a5
push str.StartLoadCustomMessageColors
push 0x10149dac
call fcn.1003aba0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret
call fcn.100ee6bd
int3
Function at 0x10079e10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10079e57
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x18]
push 0
push eax
push 6
lea eax, [ebp - 0x20]
push eax
push edi
call ebx
mov eax, 0x1112
cmp word [ebp - 0x20], ax
jne 0x10079f70
cmp dword [ebp - 0x1e], 0x36
jne 0x10079f70
cmp byte [ebp + 0x10], 0
mov eax, 0x10149de4
push esi
push 0
mov esi, 0x10149e14
cmove esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0x10149e44]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0x10149e48]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0x10149e4c]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
xor eax, dword [0x10149e50]
push 0
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0x10149e44]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0x10149e48]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0x10149e4c]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
xor eax, dword [0x10149e50]
push 0
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0x10149e44]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0x10149e48]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0x10149e4c]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
xor eax, dword [0x10149e50]
push edi
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
xor ecx, ebp
pop edi
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 0xc