joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100321e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 4], 0
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ecx]
mov esi, dword [ebx + 4]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ecx + 1]
mov dword [ebp - 0x18], ebx
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ebx + 0x18]
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov edi, dword [eax + edx*8]
cmp esi, edi
je 0x1003227b
mov esi, dword [eax + edx*8 + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x1003227b
mov esi, dword [esi + 4]
mov ax, word [ecx]
cmp ax, word [esi + 8]
jne 0x10032245
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.100332f0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100322ab
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8]
cmp eax, dword [ebx + 4]
jne 0x100322c2
mov dword [ecx + edx*8], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x100322e7
cmp eax, esi
jne 0x100322cb
mov dword [ecx + edx*8], edi
jmp 0x100322e7
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + edx*8 + 4], eax
cmp eax, edi
je 0x100322e7
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
mov dword [ebp - 4], 2
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d1fe0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x100d1fe0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x1003237a
cmp ecx, 0x200
jae 0x1003233c
shl ecx, 3
jmp 0x10032346
cmp ecx, 0x1fffffff
jae 0x10032346
add ecx, ecx
push ecx
mov ecx, ebx
call fcn.100091a0
mov eax, dword [ebx + 4]
cmp dword [eax], eax
je 0x1003237a
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
nop dword [eax + eax]
mov esi, dword [ebx + 4]
mov ecx, ebx
mov esi, dword [esi]
push esi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100321e0
cmp esi, dword [ebp + 0xc]
jne 0x10032360
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100333c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
mov ecx, dword [ebx + 0x18]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1003341b
cmp eax, edi
jne 0x10033413
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10033423
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10033423
cmp eax, edi
jne 0x10033423
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x18]
dec dword [ebx + 8]
call fcn.10009db0
lea ecx, [edi + 0x10]
call fcn.10021510
push 0x24
push dword [edi + 0x10]
call fcn.1005cbc1
push 0x2c
push edi
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 0x10
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100334e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
jb 0x100334fa
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10033517
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x10033506
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x10033551
cmp ecx, eax
jne 0x10033549
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10033559
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10033559
cmp ecx, eax
jne 0x10033559
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.10021610
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10037950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
mov ebx, dword [edi + 0xc]
mov dword [ebp - 4], ebx
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
mov edi, dword [edi + 4]
and ecx, eax
lea eax, [ecx*8]
add ecx, ecx
mov dword [ebp - 8], eax
mov eax, dword [eax + ebx]
mov edx, dword [ebx + ecx*4]
inc ecx
mov dword [ebp - 0xc], edx
lea ecx, [ebx + ecx*4]
mov dword [ebp + 8], ecx
nop word [eax + eax]
cmp edx, edi
jne 0x100379c8
mov ecx, edi
jmp 0x100379cc
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10037a16
mov ebx, dword [esi]
cmp dword [eax + 8], ebx
je 0x100379de
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
jmp 0x100379c0
mov esi, eax
mov ecx, eax
mov dword [ebp + 8], esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 4]
nop
cmp edx, edi
jne 0x100379f8
mov edx, edi
jmp 0x100379fe
mov edx, dword [esi + ecx + 4]
mov edx, dword [edx]
cmp eax, edx
je 0x10037a0e
cmp ebx, dword [eax + 8]
jne 0x10037a0e
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
jmp 0x100379f0
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + 8], eax
jne 0x10037a1a
mov ecx, edi
mov eax, edi
pop edi
xor edx, edx
pop esi
pop ebx
cmp ecx, eax
je 0x10037a2a
mov ecx, dword [ecx]
inc edx
cmp ecx, eax
jne 0x10037a23
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x10037af0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x100e850c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8518]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8504]
nop dword [eax + eax]
cmp edi, edx
jne 0x10037b58
mov ecx, edx
jmp 0x10037b5d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10037b70
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x10037b6c
mov eax, dword [eax]
jmp 0x10037b50
mov ecx, eax
jmp 0x10037b74
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10037bc8
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10037ed0
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [0x100e8508]
sub ecx, eax
cmp ecx, 1
jb 0x10037bd4
inc eax
mov ecx, 0x100e8500
mov dword [0x100e8508], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100e8504]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10037cc0
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x10037ef0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10037f63
cmp ecx, eax
jne 0x10037f5b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10037f6b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10037f6b
cmp ecx, eax
jne 0x10037f6b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8

Function at 0x100394b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x100e828c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8298]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8284]
nop dword [eax + eax]
cmp edi, edx
jne 0x10039518
mov ecx, edx
jmp 0x1003951d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10039530
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1003952c
mov eax, dword [eax]
jmp 0x10039510
mov ecx, eax
jmp 0x10039534
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10039588
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10039940
mov edx, eax
mov ecx, 0x5d1745c
mov eax, dword [0x100e8288]
sub ecx, eax
cmp ecx, 1
jb 0x10039594
inc eax
mov ecx, 0x100e8280
mov dword [0x100e8288], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100e8284]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10039730
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x100395a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x100e830c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8318]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8304]
nop dword [eax + eax]
cmp edi, edx
jne 0x10039608
mov ecx, edx
jmp 0x1003960d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10039620
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1003961c
mov eax, dword [eax]
jmp 0x10039600
mov ecx, eax
jmp 0x10039624
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10039678
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10022d90
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [0x100e8308]
sub ecx, eax
cmp ecx, 1
jb 0x10039684
inc eax
mov ecx, 0x100e8300
mov dword [0x100e8308], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100e8304]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10031e40
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1005dddf
int3

Function at 0x10039690
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100e830c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100e8318]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8304]
nop word [eax + eax]
cmp edi, edx
jne 0x100396f8
mov ecx, edx
jmp 0x100396fd
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003971a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1003970c
mov eax, dword [eax]
jmp 0x100396f0
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8
Function at 0x10039970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x100399e3
cmp ecx, eax
jne 0x100399db
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x100399eb
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x100399eb
cmp ecx, eax
jne 0x100399eb
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x2c
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8

Function at 0x1003a000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 1
push 0x6a5302
mov byte [ebp - 1], 8
call esi
test eax, eax
je 0x1003a03a
mov al, byte [ebp - 1]
mov ecx, 0x6a5302
mov byte [ecx], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ecx
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 8
push 0x6a539e
call esi
test eax, eax
je 0x1003a06f
mov eax, 0x6a539e
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push 0x6a539e
call esi
push str.Avatar_Blue_limit_is_patched_succesfully__n
call fcn.10009ff0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003aca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push 0x4142e2
call esi
test eax, eax
je 0x1003ace0
mov eax, 0x4142e2
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 8
push 0x4142e2
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x41474d
call esi
test eax, eax
je 0x1003ad12
mov eax, 0x41474d
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x41474d
call esi
push str.Green_Book_is_patched_succesfully__n
call fcn.10009ff0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003aed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x13
push 0x5805c8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003af1b
mov eax, 0x5805c8
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], cx
mov byte [eax + 0x12], cl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x13
push 0x5805c8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.QuestRaise_is_patched_succesfully__n
call fcn.10009ff0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x1003af30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 0xf
push 0x964060
call esi
test eax, eax
je 0x1003af79
mov eax, 0x964060
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xf
push 0x964060
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf
push 0x95c4e0
call esi
test eax, eax
je 0x1003afb5
mov eax, 0x95c4e0
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xf
push 0x95c4e0
call esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xc3
push eax
push 4
push 1
push 0x96406f
call esi
test eax, eax
je 0x1003afe2
mov al, byte [ebp - 1]
mov ecx, 0x96406f
mov byte [ecx], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ecx
call esi
lea eax, [ebp - 8]
push eax
push 4
push 1
push 0x95c4ef
call esi
test eax, eax
je 0x1003b00b
mov al, byte [ebp - 1]
mov ecx, 0x95c4ef
mov byte [ecx], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ecx
call esi
push str.Dump_creation_is_patched_succesfully__n
call fcn.10009ff0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003b0e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov ebx, ecx
mov esi, edx
push 0x40
push 4
lea edi, [ebx + 1]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003b11d
push 0
push dword [ebp - 4]
sub esi, ebx
push 4
sub esi, 5
push edi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003b130
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x40
push 4
push esi
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003b15d
push 0
push dword [ebp - 4]
mov dword [esi], ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ce50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xcd7dfc
push ebx
push esi
push edi
jne 0x1003cf34
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003cf34
movsx eax, word [esi + 0x84]
mov ecx, 0x100e8420
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.10037950
test eax, eax
jne 0x1003cea7
movzx eax, word [esi + 0x78]
mov ecx, 0x100e8420
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.10037950
test eax, eax
je 0x1003cf34
mov ebx, dword [ebp + 0x10]
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x100e820c]
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8218]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
lea edi, [edx + ecx*4]
mov edx, dword [0x100e8204]
cmp esi, edx
jne 0x1003cf0d
mov ecx, edx
jmp 0x1003cf12
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003cf34
cmp dword [eax + 8], ebx
je 0x1003cf1f
mov eax, dword [eax]
jmp 0x1003cf05
cmp eax, edx
je 0x1003cf34
mov eax, dword [eax + 0xc]
pop edi
pop esi
mov dword [0x100e8098], eax
mov al, 1
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
Function at 0x1003d030
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
push ebx
push esi
push edi
test eax, eax
je 0x1003d149
mov edx, dword [eax + 0x34]
movzx eax, byte [edx + 0x20]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 0x21]
xor ecx, eax
movzx eax, byte [edx + 0x22]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0x23]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100e850c]
and eax, dword [0x100e8518]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edi, dword [ecx + eax*4]
lea ebx, [ecx + eax*4]
mov ecx, dword [0x100e8504]
cmp edi, ecx
jne 0x1003d09f
mov eax, ecx
jmp 0x1003d0a4
mov eax, dword [ebx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x1003d149
mov eax, dword [esi + 8]
cmp eax, dword [edx + 0x20]
je 0x1003d0b8
mov esi, dword [esi]
jmp 0x1003d097
cmp esi, ecx
je 0x1003d149
push 0x30cf
mov eax, 0x430a00
call eax
mov dword [ebp - 8], eax
add esp, 4
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xcd
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x404090
mov edx, dword [ebp - 0xc]
push edx
mov eax, 1
mov ecx, dword [ebp - 8]
call dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], 0x404090
mov eax, dword [ecx + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, 4
mov ecx, dword [ebp - 8]
call dword [ebp - 0x14]
mov al, byte [esi + 0xc]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x404090
mov edx, dword [ebp - 0x14]
push edx
mov eax, 1
mov ecx, dword [ebp - 8]
call dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x484d90
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4