joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
sub esp, 0x28
mov ecx, 0x10154dd0
mov eax, esp
mov dword [eax], 0x10122d30
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.1001d210
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1005219b
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4996b4
call esi
mov eax, 0x10052110
mov byte [0x4996b4], 0xe9
sub eax, 0x4996b9
mov dword [0x4996b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4996b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x497bd8
call esi
mov eax, 0x10052120
mov byte [0x497bd8], 0xe9
sub eax, 0x497bdd
mov dword [0x497bd9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x497bd8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x51c170
call esi
lea eax, [esp + 4]
mov dword [0x51c170], 0x10052120
push eax
push dword [esp + 8]
push 4
push 0x51c170
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x51c178
call esi
lea eax, [esp + 4]
mov dword [0x51c178], 0x10052130
push eax
push dword [esp + 8]
push 4
push 0x51c178
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x499530
call esi
mov eax, 0x100520f0
mov byte [0x499530], 0xe8
sub eax, 0x499535
mov dword [0x499531], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x499530
call esi
pop esi
add esp, 0x10
ret

Function at 0x100557c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43aaec
call esi
mov eax, 0x100557a0
mov byte [0x43aaec], 0xe9
sub eax, 0x43aaf1
mov dword [0x43aaed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43aaec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43db54
call esi
mov eax, 0x100557b0
mov byte [0x43db54], 0xe9
sub eax, 0x43db59
mov dword [0x43db55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43db54
call esi
pop esi
pop ecx
ret

Function at 0x10056b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x434238
call esi
mov eax, 0x10056b70
mov byte [0x434238], 0xe9
sub eax, 0x43423d
mov dword [0x434239], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x434238
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43bce0
call esi
mov eax, 0x10056b80
mov byte [0x43bce0], 0xe9
sub eax, 0x43bce5
mov dword [0x43bce1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43bce0
call esi
pop esi
pop ecx
ret
Function at 0x1005c010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
call fcn.100557c0
push 0
mov edx, str.DisplayUnusedStat
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
jle 0x1005c047
push 0
mov edx, str.UnusedStatImage
mov ecx, str.Misc
call fcn.1000dcb0
inc dword [0x1013ce98]
mov dword [0x1013ce94], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43527c
call esi
mov eax, 0x1005bfe0
mov byte [0x43527c], 0xe9
sub eax, 0x435281
mov dword [0x43527d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43527c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x434b38
call esi
mov eax, 0x1005bff0
mov byte [0x434b38], 0xe9
sub eax, 0x434b3d
mov dword [0x434b39], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x434b38
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4365ac
call esi
mov eax, 0x1005c000
mov byte [0x4365ac], 0xe9
sub eax, 0x4365b1
mov dword [0x4365ad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4365ac
call esi
pop esi
pop ecx
ret

Function at 0x1005cc50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447914
call esi
mov eax, 0x1005cc20
mov byte [0x447914], 0xe9
sub eax, 0x447919
mov dword [0x447915], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447914
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x446a18
call esi
mov eax, 0x1005cc30
mov byte [0x446a18], 0xe9
sub eax, 0x446a1d
mov dword [0x446a19], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x446a18
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x446d30
call esi
mov eax, 0x1005cc40
mov byte [0x446d30], 0xe9
sub eax, 0x446d35
mov dword [0x446d31], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x446d30
call esi
pop esi
pop ecx
ret
Function at 0x1005f4f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c05c4
call esi
mov eax, 0x1005f470
mov byte [0x4c05c4], 0xe9
sub eax, 0x4c05c9
mov dword [0x4c05c5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c05c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c219c
call esi
mov eax, 0x1005f480
mov byte [0x4c219c], 0xe9
sub eax, 0x4c21a1
mov dword [0x4c219d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c219c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c2270
call esi
mov eax, 0x1005f490
mov byte [0x4c2270], 0xe9
sub eax, 0x4c2275
mov dword [0x4c2271], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c2270
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c50f4
call esi
mov eax, 0x1005f4a0
mov byte [0x4c50f4], 0xe9
sub eax, 0x4c50f9
mov dword [0x4c50f5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c50f4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c41ec
call esi
mov eax, 0x1005f4b0
mov byte [0x4c41ec], 0xe9
sub eax, 0x4c41f1
mov dword [0x4c41ed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c41ec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c3830
call esi
mov eax, 0x1005f4c0
mov byte [0x4c3830], 0xe9
sub eax, 0x4c3835
mov dword [0x4c3831], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c3830
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c4bd0
call esi
mov eax, 0x1005f4d0
mov byte [0x4c4bd0], 0xe9
sub eax, 0x4c4bd5
mov dword [0x4c4bd1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c4bd0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c2e44
call esi
mov eax, 0x1005f4e0
mov byte [0x4c2e44], 0xe9
sub eax, 0x4c2e49
mov dword [0x4c2e45], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c2e44
call esi
pop esi
pop ecx
ret
Function at 0x1006a1c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x51946c
call esi
lea eax, [esp + 4]
mov dword [0x51946c], 0x1006a1a0
push eax
push dword [esp + 8]
push 4
push 0x51946c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x519470
call esi
lea eax, [esp + 4]
mov dword [0x519470], 0x1006a1b0
push eax
push dword [esp + 8]
push 4
push 0x519470
call esi
pop esi
pop ecx
ret

Function at 0x1006a920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a908
call esi
mov eax, 0x1006aa90
mov byte [0x47a908], 0xe9
sub eax, 0x47a90d
mov dword [0x47a909], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a908
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e564
call esi
mov eax, 0x1006a8f0
mov byte [0x42e564], 0xe9
sub eax, 0x42e569
mov dword [0x42e565], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e564
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48328c
call esi
mov eax, 0x1006a900
mov byte [0x48328c], 0xe9
sub eax, 0x483291
mov dword [0x48328d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48328c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x483c98
call esi
mov eax, 0x1006a910
mov byte [0x483c98], 0xe9
sub eax, 0x483c9d
mov dword [0x483c99], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x483c98
call esi
pop esi
pop ecx
ret
Function at 0x1006b130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b12f8
call esi
mov eax, 0x1006b120
mov byte [0x4b12f8], 0xe9
sub eax, 0x4b12fd
mov dword [0x4b12f9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b12f8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b3924
call esi
mov eax, 0x1006b110
mov byte [0x4b3924], 0xe9
sub eax, 0x4b3929
mov dword [0x4b3925], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b3924
call esi
pop esi
pop ecx
ret

Function at 0x1006ccd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44df40
call esi
mov eax, 0x1006cc80
mov byte [0x44df40], 0xe9
sub eax, 0x44df45
mov dword [0x44df41], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44df40
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44c840
call esi
mov eax, 0x1006cc90
mov byte [0x44c840], 0xe9
sub eax, 0x44c845
mov dword [0x44c841], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44c840
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44b684
call esi
mov eax, 0x1006cca0
mov byte [0x44b684], 0xe9
sub eax, 0x44b689
mov dword [0x44b685], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44b684
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44ca18
call esi
mov eax, 0x1006ccb0
mov byte [0x44ca18], 0xe9
sub eax, 0x44ca1d
mov dword [0x44ca19], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44ca18
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44df94
call esi
mov eax, 0x1006ccc0
mov byte [0x44df94], 0xe9
sub eax, 0x44df99
mov dword [0x44df95], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44df94
call esi
pop esi
pop ecx
ret
Function at 0x1006f2c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a5e34
call esi
mov eax, 0x1006f240
mov byte [0x4a5e34], 0xe9
sub eax, 0x4a5e39
mov dword [0x4a5e35], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a5e34
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a390c
call esi
mov eax, 0x1006f250
mov byte [0x4a390c], 0xe9
sub eax, 0x4a3911
mov dword [0x4a390d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a390c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a39ac
call esi
mov eax, 0x1006f260
mov byte [0x4a39ac], 0xe9
sub eax, 0x4a39b1
mov dword [0x4a39ad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a39ac
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a4f28
call esi
mov eax, 0x1006ea20
mov byte [0x4a4f28], 0xe9
sub eax, 0x4a4f2d
mov dword [0x4a4f29], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a4f28
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a61d4
call esi
mov eax, 0x1006f270
mov byte [0x4a61d4], 0xe9
sub eax, 0x4a61d9
mov dword [0x4a61d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a61d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a63e0
call esi
mov eax, 0x1006f280
mov byte [0x4a63e0], 0xe9
sub eax, 0x4a63e5
mov dword [0x4a63e1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a63e0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a4810
call esi
mov eax, 0x1006f290
mov byte [0x4a4810], 0xe9
sub eax, 0x4a4815
mov dword [0x4a4811], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a4810
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a67ec
call esi
mov eax, 0x1006f2a0
mov byte [0x4a67ec], 0xe9
sub eax, 0x4a67f1
mov dword [0x4a67ed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a67ec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a67e4
call esi
mov eax, 0x1006f2b0
mov byte [0x4a67e4], 0xe9
sub eax, 0x4a67e9
mov dword [0x4a67e5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a67e4
call esi
pop esi
pop ecx
ret
Function at 0x1006ff80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 0
mov edx, str.DeathScreenFontPatch
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
mov edx, str.SpecialDeathGVAR
push 0x1eb
mov ecx, str.Misc
setne byte [0x10175031]
call fcn.1000dcb0
mov dword [0x1013ced8], eax
lea eax, [esp]
push eax
push 0x40
push 5
push 0x440bd0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1006ff70
mov byte [0x440bd0], 0xe9
sub eax, 0x440bd5
mov dword [0x440bd1], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x440bd0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10070d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4bc6f0
call esi
mov eax, 0x10070d40
mov byte [0x4bc6f0], 0xe9
sub eax, 0x4bc6f5
mov dword [0x4bc6f1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4bc6f0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447fa0
call esi
mov eax, 0x10070d50
mov byte [0x447fa0], 0xe9
sub eax, 0x447fa5
mov dword [0x447fa1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447fa0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43186c
call esi
mov eax, 0x10070cc0
mov byte [0x43186c], 0xe9
sub eax, 0x431871
mov dword [0x43186d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43186c
call esi
pop esi
pop ecx
ret

Function at 0x10071410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push 0
mov edx, str.DisableSpecialMapIDs
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
je 0x10071485
cmp byte [0x10174f84], 0
je 0x10071471
test byte [0x10174f88], 1
je 0x10071471
mov edx, str.Applying_disable_handling_special_maps_patch.
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x10071471
mov edx, str.Applying_disable_handling_special_maps_patch.
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
mov dword [0x1013cee0], 0xffffffff
mov dword [0x1013cedc], 0xffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48411c
call esi
mov eax, 0x100713f0
mov byte [0x48411c], 0xe9
sub eax, 0x484121
mov dword [0x48411d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48411c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x482158
call esi
mov eax, 0x10071400
mov byte [0x482158], 0xe9
sub eax, 0x48215d
mov dword [0x482159], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x482158
call esi
pop esi
pop ecx
ret
Function at 0x10071f70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x415efc
call esi
mov eax, 0x10071f40
mov byte [0x415efc], 0xe9
sub eax, 0x415f01
mov dword [0x415efd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x415efc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4163c8
call esi
mov eax, 0x10071f60
mov byte [0x4163c8], 0xe9
sub eax, 0x4163cd
mov dword [0x4163c9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4163c8
call esi
mov eax, dword [0x10153db4]
sub eax, dword [0x10153dac]
sar eax, 4
pop esi
cmp eax, 0x9c40
jae 0x10072008
push 0x9c40
call fcn.10072110
push dword [0x1013cee4]
call fcn.10072020
pop ecx
ret

Function at 0x10072c70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49d4d4
call esi
mov eax, 0x10072c30
mov byte [0x49d4d4], 0xe9
sub eax, 0x49d4d9
mov dword [0x49d4d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49d4d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44cec4
call esi
mov eax, 0x10072c40
mov byte [0x44cec4], 0xe9
sub eax, 0x44cec9
mov dword [0x44cec5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44cec4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48a568
call esi
mov eax, 0x10072c50
mov byte [0x48a568], 0xe9
sub eax, 0x48a56d
mov dword [0x48a569], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48a568
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48d8e8
call esi
mov eax, 0x10072c60
mov byte [0x48d8e8], 0xe9
sub eax, 0x48d8ed
mov dword [0x48d8e9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48d8e8
call esi
pop esi
pop ecx
ret

Function at 0x10073090
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1754
call esi
mov eax, 0x10073060
mov byte [0x4b1754], 0xe9
sub eax, 0x4b1759
mov dword [0x4b1755], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1754
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b185c
call esi
mov eax, 0x10073070
mov byte [0x4b185c], 0xe9
sub eax, 0x4b1861
mov dword [0x4b185d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b185c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1a6c
call esi
mov eax, 0x10073080
mov byte [0x4b1a6c], 0xe9
sub eax, 0x4b1a71
mov dword [0x4b1a6d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1a6c
call esi
pop esi
pop ecx
ret
Function at 0x10073e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10071410
call fcn.10072c70
call fcn.10073090
call fcn.10071f70
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48b848
call esi
mov eax, 0x10073de0
mov byte [0x48b848], 0xe9
sub eax, 0x48b84d
mov dword [0x48b849], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48b848
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48b930
call esi
mov eax, 0x10073df0
mov byte [0x48b930], 0xe9
sub eax, 0x48b935
mov dword [0x48b931], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48b930
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1b84
call esi
mov eax, 0x10073e00
mov byte [0x4b1b84], 0xe9
sub eax, 0x4b1b89
mov dword [0x4b1b85], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1b84
call esi
pop esi
pop ecx
ret

Function at 0x100741a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100740f0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3338
call esi
mov eax, 0x10074160
mov byte [0x4a3338], 0xe9
sub eax, 0x4a333d
mov dword [0x4a3339], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3338
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a34cc
call esi
mov eax, 0x10074170
mov byte [0x4a34cc], 0xe9
sub eax, 0x4a34d1
mov dword [0x4a34cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a34cc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3518
call esi
mov eax, 0x10074180
mov byte [0x4a3518], 0xe9
sub eax, 0x4a351d
mov dword [0x4a3519], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3518
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a347c
call esi
mov eax, 0x10074190
mov byte [0x4a347c], 0xe9
sub eax, 0x4a3481
mov dword [0x4a347d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a347c
call esi
pop esi
pop ecx
ret

Function at 0x10074570
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100741a0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3d84
call esi
mov eax, 0x10074540
mov byte [0x4a3d84], 0xe9
sub eax, 0x4a3d89
mov dword [0x4a3d85], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3d84
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2834
call esi
mov eax, 0x10074550
mov byte [0x4a2834], 0xe9
sub eax, 0x4a2839
mov dword [0x4a2835], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2834
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3620
call esi
mov eax, 0x10074560
mov byte [0x4a3620], 0xe9
sub eax, 0x4a3625
mov dword [0x4a3621], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3620
call esi
pop esi
pop ecx
ret