joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb8463e
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + ecx - 0x5f50438], ecx
not edx
xadd cx, ax
dec word [esp + ecx - 0x5f57d4e]
and dword [esp + ecx*4 - 0x17d5f53c], ecx
dec edx
call fcn.00b784d4
dec ecx
sub edx, 1
mov edx, 0x1c8a812d
inc esi
movzx eax, byte [edx + edx - 0x1c8a812d]
movsx ebp, dx
inc eax
movzx eax, ch
dec eax
imul eax, eax
inc esp
xor al, bl

Function at 0xb84c4c
Capabilities:
Encode data using base64

Disassembly:
lea eax, [ecx + ecx*4 - 0x605d74e8]
or dword [esp + eax - 0x4e9988be], eax
xor dl, 0xac
cwde
shr ecx, cl
dec dl
div byte [esp + ecx*2 - 0x44b24c89]
xor bl, dl
lea ebp, [ebp + ecx - 0x2259264a]
mov dword [esp + ecx*2 - 0x44b24c90], 0x67b32a29
mov word [ebp + ecx*2 - 0x44b24c90], dx
add dword [esp + ecx*2 - 0x44b24c8f], eax
adc cl, cl
movsx edx, byte [esp + ecx - 0x22592691]
pop ecx
pop eax
jnp fcn.00989a2c

Function at 0xb897a1
Capabilities:
Encode data using base64

Disassembly:
mul dl
dec eax
mov dword [esp + edx*2 + 8], ebx
sbb ecx, 0x4f304bbe
inc cx
shl esp, 0x8d
inc esp
xor dword [esp + edx*8 + 8], ebx
dec eax
mov dword [esp + edx*4], edx
dec eax
mov ebx, dword [esp + edx + 8]
rol ebp, cl
dec esp
mov dword [esp + edx + 8], ebp
cwde
dec ebp
arpl bx, bx
not bp
rol dword [esp + edx], cl
and dword [esp + edx + 0xa], 0x13b1081b
dec ecx
adc edi, ebx
dec eax
ror eax, 0xf8
inc ecx
pop eax
inc ecx
pop edi
jae fcn.00987526

Function at 0xb898ab
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 8
jmp 0xb6ff31
jmp 0x9a85b7
jne 0xa8c22b

Function at 0xb8b044
Capabilities:
Encode data using base64

Disassembly:
call fcn.00a0c746
mov eax, 0xe8b25d10
sub ebp, 4
movsx ecx, ax
push ecx
mov edx, dword [ebp + ecx - 0x5d10]
xor edx, ebx
rol edx, 2
lea ecx, [eax*2 + 0x2c02aa1d]
and cl, 0x9d
bswap edx
call fcn.00996dab

Function at 0xe9f907
Capabilities:
Encode data using base64

Disassembly:
xadd ax, dx
rol ecx, 3
sar edx, 1
imul eax
push eax
lea ecx, [ecx + edx*4 - 0x74cdf7b0]
btr ax, 0xe
xor ebx, ecx
shr dl, 0xc6
jnp 0xa2e0b2
imul ax, dx
add edi, ecx
neg eax
rol edx, 0x3d
call fcn.00a75e45
mov eax, 0xb68f6b21
bts eax, eax
movzx ecx, al
mov eax, dword [esi + ecx*2 - 0x46]
jae 0x98c34a
Function at 0xeaf735
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + ecx + 0x5465f061]
mov word [esp + ecx - 0x46215048], cx
adc ecx, dword [esp + ecx - 0x46215048]
and ecx, dword [esp + edx]
bswap eax
xchg dword [esp + ecx*8 - 0x2c400000], ecx
btr edx, edx
dec edx
mov dword [esp + ebx - 0x4f31a03b], edx
dec eax
lea esi, [esp + esi + 8]
inc ebp
xchg eax, esp
inc si
mov dword [esp - 0xc970], ebx
dec edx
mov dword [esi - 0x64b8], eax
inc edx
xor cl, byte [esp - 0x325a]
not ebp
inc ecx
neg edi
dec ebx
mov esi, dword [esp + ecx - 0x3254]
dec edx
sal dword [esp - 0x64b8], 0x9e
inc edi
movzx ebx, byte [edx - 0x325e]
inc esp
xor bl, bl
inc ecx
xor dh, 0x9e
inc ecx
adc bl, 0xb1
inc edx
sar byte [esp - 0x64b3], 0xc5
inc edx
sar dword [esp - 0xc970], cl
inc edx
mov byte [esp - 0xc96e], 0x29
inc ecx
neg bl
inc ecx
inc edi
dec eax
not ecx
dec edx
inc dword [esp - 0x325c]
inc ecx
xor bl, 0x30
inc esp
sub byte [esp + ebp*2 - 0x72d9f411], dh
inc edx
imul ecx, dword [esp - 0x325c]
inc ecx
adc bl, 0xf
inc ecx
xor bl, bl
inc edx
sar dword [esp - 0x64b5], cl
inc edx
or dword [esp - 0x325b], 0x5c229184
dec esi
lea ebx, [esp + ebx + 8]
dec ebx
mov dword [esp + ebx - 0x325c], esi
dec eax
not ebp
inc edx
xor dword [esp - 0x64b7], ecx
inc edi
mov edi, dword [edx - 0x64be]
inc eax
neg ch
dec edi
lea ebx, [eax + eax + 0x45bbc4bc]
dec edx
and dword [esp - 0x325c], ecx
dec edi
lea edx, [esp + edx - 0x3262]
inc ecx
pop esp
inc esp
xor edi, ebx
inc ecx
ror esi, cl
jae 0x970eca
inc ecx
dec edi
inc ecx
push esp
inc cx
not eax
inc ecx
neg edi
inc edx
ror dword [esp - 0x20007fd], 9
inc ecx
dec edi
inc ecx
neg edi
inc cx
shl esp, 0xc5
inc edx
sbb dword [esp - 0x800007c], 0x450a9aa8
inc edx
sal byte [esp - 0x200001d], 0x87
dec edx
mov dword [esp - 0x8000080], ebx
inc ecx
mov esi, ebp
inc cx
sal esp, 0xc8
inc cx
sal ebp, 0x21
inc esi
xor dword [esp - 0x2002000], edi
pop ebx
inc sp
bts esi, ebx
jb 0x99c502
mov edx, 0x2b0d3a83
sar edx, 0xfe
movsx eax, dx
add eax, dword [ebp + edx*2]
lea ecx, [edx + edx*8 - 0x58da2cca]
xor edx, dword [ebp + edx*8 + 4]
mov dword [eax], edx
mov eax, ecx
mov eax, dword [esi]
movzx edx, cl
lea edx, [ecx + edx*8 + 0xcbdd285]
xor eax, ebx
bswap eax
add edx, 0x712ae33d
neg eax
push edx
lea eax, [eax + edx*2 + 0x5dfafe69]
rol eax, 1
inc eax
or word [esp + edx - 0x250e8aa7], 0x3712
shl edx, 0x94
and edx, edx
xor ebx, eax
dec cx
not ecx
add edi, eax
not edx
movsx eax, cl
mov eax, dword [ebp + ecx - 0x58da2cc2]
xor ecx, 0x492d2d97
lea ebp, [ebp + ecx - 0x11f70151]
movzx edx, byte [esi + ecx - 0x11f70159]
jle 0x9c4230
add ecx, ecx
xchg byte [esp + ecx*2 - 0x47dc0574], cl
lea esi, [ecx + esi - 0x23ee02a3]
call fcn.00961f09
Function at 0x100018c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
xor edx, edx
push ebx
movzx eax, al
mov dword [ebp - 0x14], edx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x100018e8
xor al, al
jmp 0x10001904
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov bl, byte [esi]
test al, al
je 0x10001922
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e12b
mov esp, ebp
pop ebp
ret

Function at 0x10001940
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0x10]
mov dword [ebp - 0x14], 0
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1000197c
mov byte [ebp - 8], al
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
mov byte [ebp - 8], al
mov byte [esi], bl
test al, al
je 0x100019b5
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e12b
mov esp, ebp
pop ebp
ret

Function at 0x100019d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
shl eax, 2
mov dword [ebp - 0x14], 0
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x10001a0f
mov byte [ebp - 8], al
mov dword [esi], edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
mov byte [ebp - 8], al
mov dword [esi], edi
test al, al
je 0x10001a48
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x10002540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080e00
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100beb60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1004dbe9
mov esi, eax
add esp, 4
test esi, esi
je 0x100025a0
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1004d2b8
add esp, 4
mov dword [esi + 4], eax
jmp 0x100025a2
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov byte [ebp - 0x18], cl
mov esi, eax
movzx ecx, cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], edx
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jne 0x1000484a
xor cl, cl
jmp 0x10004865
lea edx, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x14], eax
call ebx
mov edx, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov ch, byte [esi]
mov byte [ebp - 0x1d], ch
test cl, cl
je 0x10004888
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push edx
call ebx
mov eax, dword [ebp + 0xc]
mov ch, byte [ebp - 0x1d]
movzx ecx, ch
sub ecx, 0xe8
je 0x10004939
sub ecx, 1
je 0x10004939
sub ecx, 0x16
jne 0x10004920
push dword [ebp - 0x18]
inc eax
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.100018c0
add esp, 8
cmp al, 0x15
je 0x100048be
cmp al, 0x25
jne 0x10004920
mov eax, dword [ebp - 0x24]
xor edx, edx
mov esi, dword [ebp + 0xc]
shl eax, 2
add esi, 2
mov dword [ebp - 0x14], edx
test eax, eax
jne 0x100048d7
xor al, al
jmp 0x100048ef
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call ebx
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov esi, dword [esi]
test al, al
je 0x10004909
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
push edx
call ebx
mov ecx, dword [esi]
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
lea esi, [eax + 1]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
shl eax, 2
mov dword [ebp - 0x14], ecx
test eax, eax
jne 0x1000494f
xor al, al
jmp 0x10004967
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call ebx
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov edx, dword [esi]
mov dword [ebp - 0x1c], edx
test al, al
je 0x10004987
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push ecx
call ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
lea eax, [edx + 4]
add eax, esi
xor ecx, ebp
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x100049b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100bfd1f], 0
push esi
push edi
je 0x10004ae3
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0xe6b45e
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
push 1
push ecx
mov eax, esp
mov dword [eax], esi
lea eax, [ebp - 8]
push eax
call fcn.10004810
add esp, 0xc
push 1
push 0xe9
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.10001940
add esp, 0xc
inc esi
push 1
push 4
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x10004b50
mov eax, esp
mov dword [eax], esi
call fcn.100055d0
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add esp, 0x10
add eax, 0xe6b463
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0x90
cmp byte [ebp - 0xc], 0
je 0x10004a7a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0x4e98cd
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 3
push esi
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x18], esi
call edi
test eax, eax
mov eax, 0x90909090
setne byte [ebp - 0xc]
mov word [esi], ax
mov byte [esi + 2], al
cmp byte [ebp - 0xc], 0
je 0x10004b40
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
push 1
push 6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xc7
push eax
mov eax, dword [0x100bfd04]
push ecx
add eax, 0xe6b45e
mov word [ebp - 0x1c], 0
mov ecx, esp
mov word [ebp - 8], 0x4689
push eax
mov byte [ebp - 6], 0x10
call fcn.10002c20
call fcn.10007cc0
add esp, 0x10
lea eax, [ebp - 8]
push 1
push 3
push eax
mov eax, dword [0x100bfd04]
push ecx
add eax, 0x4e98cd
mov ecx, esp
push eax
call fcn.10002c20
call fcn.10007cc0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x10004b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100bfd04]
add eax, 0x81b440
cmp byte [0x100bfd70], 0
push esi
je 0x10004c52
push eax
lea ecx, [ebp - 8]
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 6
push esi
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, 0x90909090
setne byte [ebp - 0xc]
mov dword [esi], eax
mov word [esi + 4], ax
cmp byte [ebp - 0xc], 0
je 0x10004beb
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0x81b440
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
push 1
push ecx
mov eax, esp
mov dword [eax], esi
lea eax, [ebp - 8]
push eax
call fcn.10004810
add esp, 0xc
push 1
push 0xe9
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.10001940
add esp, 0xc
inc esi
push 1
push 4
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x10005000
mov eax, esp
mov dword [eax], esi
call fcn.100055d0
add esp, 0x10
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
push 1
push 6
push 0x100bfce0
push ecx
mov ecx, esp
push eax
call fcn.10002c20
call fcn.10007cc0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x10004c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100bfd1a], 0
push esi
push edi
je 0x10004d73
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0x787859
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 6
push esi
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x18], esi
call edi
test eax, eax
mov eax, 0x90909090
setne byte [ebp - 0xc]
mov dword [esi], eax
mov word [esi + 4], ax
cmp byte [ebp - 0xc], 0
je 0x10004d0a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0x787865
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 6
push esi
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x18], esi
call edi
test eax, eax
mov eax, 0x90909090
setne byte [ebp - 0xc]
mov dword [esi], eax
mov word [esi + 4], ax
cmp byte [ebp - 0xc], 0
je 0x10004dd3
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
push 1
push 6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x8708129
push eax
mov eax, dword [0x100bfd04]
push ecx
add eax, 0x787859
mov word [ebp - 0x1c], 0
mov ecx, esp
push eax
call fcn.10002c20
call fcn.10007cc0
add esp, 0x10
mov dword [ebp - 0x20], 0x8709129
lea eax, [ebp - 0x20]
mov word [ebp - 0x1c], 0
push 1
push 6
push eax
mov eax, dword [0x100bfd04]
push ecx
add eax, 0x787865
mov ecx, esp
push eax
call fcn.10002c20
call fcn.10007cc0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x10004e00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100bfd1c], 0
push esi
push edi
je 0x10004f83
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0x5499f3
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
push 1
push ecx
mov eax, esp
mov dword [eax], esi
lea eax, [ebp - 8]
push eax
call fcn.10004810
add esp, 0xc
push 1
push 0xe9
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.10001940
add esp, 0xc
inc esi
push 1
push 4
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x10004df0
mov eax, esp
mov dword [eax], esi
call fcn.100055d0
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add esp, 0x10
add eax, 0x5499f8
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0x90
cmp byte [ebp - 0xc], 0
je 0x10004eca
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0x54d8d0
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
push 1
push ecx
mov eax, esp
mov dword [eax], esi
lea eax, [ebp - 8]
push eax
call fcn.10004810
add esp, 0xc
push 1
push 0xe9
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.10001940
add esp, 0xc
inc esi
push 1
push 4
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x10004c80
mov eax, esp
mov dword [eax], esi
call fcn.100055d0
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add esp, 0x10
add eax, 0x54d8d5
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0x90
cmp byte [ebp - 0xc], 0
je 0x10004fe3
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
push 1
push 6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x89684189
push eax
mov eax, dword [0x100bfd04]
push ecx
add eax, 0x5499f3
mov word [ebp - 0x1c], 0x5c51
mov ecx, esp
mov dword [ebp - 0x28], 0x8b5449ff
push eax
mov word [ebp - 0x24], 0x5441
call fcn.10002c20
call fcn.10007cc0
add esp, 0x10
lea eax, [ebp - 0x28]
push 1
push 6
push eax
mov eax, dword [0x100bfd04]
push ecx
add eax, 0x54d8d0
mov ecx, esp
push eax
call fcn.10002c20
call fcn.10007cc0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x10005010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100bfd18], 0
push esi
jne 0x10005112
mov eax, dword [0x100bfd04]
lea ecx, [ebp - 8]
add eax, 0x81b440
push eax
call fcn.10002c20
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 6
push esi
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov ecx, dword [esi]
mov dword [0x100bfce0], ecx
mov cx, word [esi + 4]
mov word [0x100bfce4], cx
test eax, eax
je 0x10005091
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.10005130
call fcn.10006810
mov esi, dword [0x100bfd04]
push 0x100bfd00
push 0x100090e0
add esi, 0x68ee30
push esi
call fcn.1004bd60
push esi
call fcn.1004bf70
mov esi, dword [0x100bfd04]
push 0x100bfd74
push 0x100072e0
add esi, 0x813de0
push esi
call fcn.1004bd60
push esi
call fcn.1004bf70
mov eax, dword [0x100bfd78]
sub eax, 2
je 0x10005101
sub eax, 6
je 0x100050fa
sub eax, 1
jne 0x1000510b
call fcn.10005bd0
jmp 0x1000510b
call fcn.10005930
jmp 0x1000510b
mov dword [0x100bfd78], 0
mov byte [0x100bfd18], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1004e12b
mov esp, ebp
pop ebp
ret