joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100025b8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 4
push dword [ebp + 8]
xor eax, eax
call dword [0x10030507]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002606
push 0x33
push 0x401bb8a
push 6
call fcn.10010853
add esp, 0xc
test eax, eax
je 0x10002613
jmp 0x100026c2
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000264d
push 0x6d
push 0x401bb8a
push 6
call fcn.10010853
add esp, 0xc
push 0x80000501
push 0
lea eax, [ebp - 4]
push eax
push 1
mov ebx, 0xc
mov eax, 0x100134e0
call fcn.10010cd0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 4
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.10001d86
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100026c2
push 0xdd
push 0x401bb8a
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret 8

Function at 0x100033e1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f5ae]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x1000363b
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100303c7
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100303c3
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100303c7]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000347f
push 0x7b
push 0x401354e
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10003647
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f5c6]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10003a2e
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100303cf
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100303cb
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100303cf]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x100036e5
push 0x7b
push 0x401354b
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000386f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x100038a2
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.10010847
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100038b3
push ebx
call fcn.1001084d
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp + 8]
xor eax, eax
call dword [0x10030507]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100038e8
push 0x33
push 0x401bb8c
push 6
call fcn.10010853
add esp, 0xc
test eax, eax
je 0x100038f5
jmp 0x10003a18
push 0x80000005
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x1000390a
mov eax, 0x1002f3ea
push eax
push 1
mov ebx, 0x194
call fcn.100115e0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 8]
push eax
push 0x40
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10003958
push 0x86
push 0x401bb8c
push 6
call fcn.10010853
add esp, 0xc
push 0x80000005
push 0
lea eax, [ebp - 4]
push eax
push 1
mov ebx, 0xc
mov eax, 0x100134e0
call fcn.10010cd0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003990
mov eax, 0x1002f3ea
push eax
push 1
mov ebx, 0x194
call fcn.100115e0
add esp, 0x10
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.10001d86
push 0x80000005
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x100039c4
mov eax, 0x1002f3ea
push eax
push 1
mov ebx, 0x194
call fcn.100115e0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10003a18
push 0x118
push 0x401bb8c
push 6
call fcn.10010853
add esp, 0xc
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003a28
push ebx
call fcn.1001084d
add esp, 4
mov esp, ebp
pop ebp
ret 8
Function at 0x10003a3a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f5f0]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10003be4
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100303d7
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100303d3
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100303d7]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10003ad8
push 0x7b
push 0x40136f1
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10004a3e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f75f]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10004c98
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x10030427
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030423
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x10030427]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10004adc
push 0x7b
push 0x4016d87
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10004ca4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f767]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10004ecc
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x1003042f
push dword [ebp - 8]
push dword [ebp - 4]
push 0x1003042b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x1003042f]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10004d42
push 0x7b
push 0x4016d84
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10004ed8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f77f]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10005024
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x10030437
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030433
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x10030437]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10004f76
push 0x7b
push 0x4016d81
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10005793
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f787]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10005805
push 0x3d
push 0x4012afa
push 6
call fcn.10010853
add esp, 0xc
push 0x10005b49
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x1003043f
push dword [ebp - 8]
push dword [ebp - 4]
push 0x1003043b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x1003043f]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10005873
push 0xb0
push 0x4012afa
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10005b55
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f78f]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f797]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [0x100303db], eax
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f79f]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [0x10030443], eax
push 0x10005dbc
call fcn.10001e43
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x1002f445]
fstp qword [ebp - 0x18]
push 1
push 0x1003044b
fld qword [ebp - 0x18]
call fcn.1000117d
push eax
push dword [ebp - 4]
push 0x10030447
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x1003044b]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10005c4f
push 0x124
push 0x40125ee
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10005dc8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7a7]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10006089
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x10030453
push dword [ebp - 8]
push dword [ebp - 4]
push 0x1003044f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x10030453]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10005e66
push 0x7b
push 0x401297f
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10006095
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7af]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x100062b6
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x1003045b
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030457
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x1003045b]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10006133
push 0x7b
push 0x4012e20
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100062c2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7b7]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10006594
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x10030467
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030463
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x10030467]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10006360
push 0x7b
push 0x4013745
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100065a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7c7]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10006826
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x10030473
push dword [ebp - 8]
push dword [ebp - 4]
push 0x1003046f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x10030473]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000663e
push 0x7b
push 0x4012d6e
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10006832
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7cf]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10006ad5
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x1003047b
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030477
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x1003047b]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x100068d0
push 0x7b
push 0x4012d98
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10006ae1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7d7]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10006d55
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x10030483
push dword [ebp - 8]
push dword [ebp - 4]
push 0x1003047f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x10030483]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10006b7f
push 0x7b
push 0x4012dcc
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10006d61
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7df]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10007033
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x1003048b
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030487
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x1003048b]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10006dff
push 0x7b
push 0x40131dd
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000703f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7e7]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10007340
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x10030497
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030493
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x10030497]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x100070dd
push 0x7b
push 0x40131f7
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1000734c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003034b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f7f7]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x1000748d
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304a3
push dword [ebp - 8]
push dword [ebp - 4]
push 0x1003049f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304a3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x100073ea
push 0x7b
push 0x4012e5f
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10007499
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f80f]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x100079e4
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304ab
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304a7
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304ab]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10007537
push 0x7b
push 0x4016cd3
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100079f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003034b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f8cf]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10009b84
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304b3
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304af
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304b3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10007a8e
push 0x7b
push 0x4012708
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003034b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f9ca]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10009c02
push 0x3d
push 0x4012a3c
push 6
call fcn.10010853
add esp, 0xc
push 0x10009eca
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304bb
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304b7
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304bb]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10009c70
push 0xb0
push 0x4012a3c
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009ed6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f9e5]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x1000a1cc
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304c3
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304bf
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304c3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10009f74
push 0x7b
push 0x40131b4
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret