joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001010
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000101c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001026
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001030
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000103a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001044
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000104e
or eax, 2
test cl, 2
je 0x10001056
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001110
test al, 1
je 0x1000111d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001110
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001004
pop edi
pop ebx
ret

Function at 0x10001140
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1005a668
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001172
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x100011a0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001203
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100011e9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x100011c8
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x100011c0
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10001fa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x100d0438]
fld dword [eax]
mov ecx, dword [0x100d0444]
fld dword [0x100d0464]
push esi
fdiv qword [0x1005c480]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x100d0448]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
push edi
fdivp st(1)
fstp dword [esp + 0x1c]
fld qword [ecx]
fsub qword [0x1005c6d8]
fabs
fstp qword [esp + 0x28]
call esi
fld dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
fmul qword [0x1005cba0]
lea eax, [esp + 0x10]
push eax
push ecx
fstp dword [esp + 0x1c]
push 8
fld dword [esp + 0x20]
push edi
fld qword [esp + 0x28]
fmul qword [0x1005c4b0]
faddp st(1)
fstp qword [edi]
call esi
mov edx, dword [0x100d0444]
fld qword [edx]
mov edi, dword [0x100d044c]
fsub qword [0x1005c6d8]
lea eax, [esp + 0x10]
push eax
push 0x40
push 8
fabs
push edi
fstp qword [esp + 0x28]
call esi
fld qword [esp + 0x18]
fmul qword [0x1005c4b0]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
fadd qword [0x1005cb98]
push edx
push 8
push edi
fstp qword [edi]
call esi
mov eax, dword [0x100d0444]
fld qword [eax]
mov edi, dword [0x100d0450]
fsub qword [0x1005c6d8]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x28]
call esi
fld qword [esp + 0x18]
fstp dword [esp + 0x14]
lea edx, [esp + 0x10]
fld dword [esp + 0x14]
fmul qword [0x1005c4b0]
fld dword [esp + 0xc]
fmul qword [0x1005cb90]
fstp dword [esp + 0x14]
fadd dword [esp + 0x14]
fstp dword [edi]
mov eax, dword [esp + 0x10]
push edx
push eax
push 4
push edi
call esi
mov ecx, dword [0x100d0444]
fld qword [ecx]
mov edi, dword [0x100d0454]
fsub qword [0x1005c6d8]
lea edx, [esp + 0x10]
push edx
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x28]
call esi
fld qword [esp + 0x18]
mov ecx, dword [esp + 0x10]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
lea eax, [esp + 0x10]
fmul qword [0x1005c4b0]
push eax
push ecx
push 4
fadd qword [0x1005cb88]
push edi
fstp dword [edi]
call esi
mov edx, dword [0x100d0444]
fld qword [edx]
mov edi, dword [0x100d0458]
fsub qword [0x1005c6d8]
lea eax, [esp + 0x10]
push eax
push 0x40
fabs
push 4
fstp dword [esp + 0x20]
push edi
fld dword [esp + 0x24]
fmul qword [0x1005c4b0]
fld dword [0x100d0490]
fdiv qword [0x1005c480]
fmul dword [esp + 0x1c]
fstp dword [esp + 0x24]
fadd dword [esp + 0x24]
fstp dword [esp + 0x24]
call esi
mov edx, dword [esp + 0x10]
fld dword [esp + 0x14]
lea ecx, [esp + 0x10]
fstp dword [edi]
push ecx
push edx
push 4
push edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002180
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [0x100d0460], 0
push esi
push edi
je 0x10002357
mov edi, dword [0x100d0438]
fld dword [0x100d0464]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x100d0468]
mov edi, dword [0x100d043c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x100d046c]
mov edi, dword [0x100d0440]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld qword [0x100d0470]
mov edi, dword [0x100d0444]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x100d0478]
mov edi, dword [0x100d0448]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x100d0480]
mov edi, dword [0x100d044c]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld dword [0x100d0488]
mov edi, dword [0x100d0450]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x100d048c]
mov edi, dword [0x100d0454]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x100d0490]
mov edi, dword [0x100d0458]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002a80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
mov ebx, 1
push ebx
push 0x813bf4
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x813bf4], bl
mov edx, dword [ebp - 4]
push edx
push ebx
push 0x813bf4
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push 0x4ebd07
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4ebd07], bl
mov edx, dword [ebp - 4]
push edx
push ebx
push 0x4ebd07
call esi
push 0x100026d0
push 0x4d9d0e
mov bl, 0xe8
call fcn.10053c00
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x59788f
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x59788f], 0x14
mov edx, dword [ebp - 4]
push edx
push 1
push 0x59788f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x597897
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x597897], 0xa
mov edx, dword [ebp - 4]
push edx
push 1
push 0x597897
call esi
push 0x100029d0
push 0x588277
mov bl, 0xe9
call fcn.10053c00
push 0x100029f0
push 0x588460
call fcn.10053c00
push 0x10002a10
push 0x588560
call fcn.10053c00
push 0x10002a30
push 0x4f0356
mov bl, 0xe8
call fcn.10053c00
push 0x10002900
push 0x51cb60
mov bl, 0xe9
call fcn.10053c00
push 0x100027f0
push 0x51e440
call fcn.10053c00
add esp, 0x30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100039e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x100037c0
push 0x40487d
mov bl, 0xe8
call fcn.10053c00
push 0x100037c0
push 0x48e56c
call fcn.10053c00
push 0x100037c0
push 0x57d4ff
call fcn.10053c00
push 0x100037c0
push 0x57d513
call fcn.10053c00
push 0x572370
push 0x572346
mov bl, 0xe9
call fcn.10053c00
push 0x10002d40
push 0x5750e2
call fcn.10053c00
push 0x10002f10
push 0x5fad70
call fcn.10053c00
push 0x10002ff0
push 0x5757d4
call fcn.10053c00
add esp, 0x40
push 0x10002cc0
push 0x633fb3
mov bl, 0xe8
call fcn.10053c00
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x574695
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x574695], 6
mov edx, dword [ebp - 4]
push edx
push 4
push 0x574695
call esi
push 0x100036c0
push 0x5748ff
mov bl, 0xe9
call fcn.10053c00
push 0x10003750
push 0x5751d1
call fcn.10053c00
push 0x10003730
push 0x5750fb
call fcn.10053c00
push 0x10002f50
push 0x576058
call fcn.10053c00
push 0x10002fa0
push 0x576141
call fcn.10053c00
push 0x10003020
push 0x836449
call fcn.10053c00
push 0x10003040
push 0x83629c
call fcn.10053c00
add esp, 0x38
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x483414
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x483414], 0
mov edx, dword [ebp - 4]
push edx
push 1
push 0x483414
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x483402
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x483402], 7
mov edx, dword [ebp - 4]
push edx
push 4
push 0x483402
call esi
push 0x10004cf0
push 0x4d5691
mov bl, 0xe8
call fcn.10053c00
push 0x10004e10
push 0x48346b
call fcn.10053c00
push 0x10004de0
push 0x48345d
call fcn.10053c00
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d5703
call esi
mov edi, str.Interface_none.tga
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d5703], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d5703
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d5723
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d5723], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d5723
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d5743
call esi
lea ecx, [ebp - 4]
mov dword [0x4d5743], edi
push ecx
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d5743
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d5763
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d5763], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d5763
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d57c8
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d57c8], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d57c8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d57e8
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d57e8], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d57e8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d5808
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d5808], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d5808
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d5828
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d5828], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d5828
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d56cd
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d56cd], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d56cd
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d56ad
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d56ad], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d56ad
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d566d
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d566d], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d566d
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d562d
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d562d], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d562d
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.._ExgConfigs.ini
push 0x400
push 0x100b9578
push 0x1005a838
push str.Notice_1
push str.Notice
call esi
push str.._ExgConfigs.ini
push 0x400
push 0x100b9178
push 0x1005a838
push str.Notice_2
push str.Notice
call esi
cmp dword [0x100b997c], 0
mov dword [0x100b9084], 0
jne 0x1000a4ba
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x100b9978]
push eax
push 0x1000a530
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x100b997c], eax
test eax, eax
jne 0x1000a4ba
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x1000a3f0
push 5
sub ecx, 0x4d0e34
push 0x4d0e2f
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x1000a518
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x4d0e2f
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x4d0e2f
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1000a51e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000aef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100c810c]
sub esp, 0x10
push esi
xor esi, esi
cmp dword [eax + 0x3a0], esi
jne 0x1000b05a
push ebx
push edi
push 0x1000a810
push 0x5edda9
mov bl, 0xe8
call fcn.10053c00
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x4d6c2c
lea ebx, [esi + 0x4c]
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x1000af5a
mov edx, 0x4d6c2c
mov dword [edx], ebx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 4
push edx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1000af60
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1000a700
push 0x4d712a
mov bl, 0xe8
call fcn.10053c00
mov edx, dword [0x100c810c]
add esp, 8
cmp dword [edx + 0x3ac], 1
jne 0x1000afa1
push 0x1e0
mov esi, 0x4d7179
call fcn.100532f0
push 0
mov esi, 0x4d7183
call fcn.10053290
add esp, 8
mov esi, 5
mov ebx, 0x63d1ce
call fcn.100533c0
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1000ae90
push 5
sub eax, 0x63d1d3
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x1000aff6
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1000affc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 5
mov ebx, 0x63d40f
call fcn.100533c0
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x1000aec0
push 5
sub ecx, 0x63d414
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x1000b052
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1000b058
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b060
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
fld dword [0x1005ccc8]
push ebx
fstp dword [0x100bd0bc]
push esi
fld dword [0x1005caa8]
xor eax, eax
fstp dword [0x100bd0c0]
push edi
fld dword [0x1005cfe8]
push 0x1000b2c0
fstp dword [0x100bd0c4]
mov edi, 0xc942
fld dword [0x1005cfe4]
push 0x4d5ee6
fstp dword [0x100bd0c8]
mov bl, 0xe8
fld dword [0x1005cfe0]
mov dword [0x100bd0d4], eax
fstp dword [0x100bd0cc]
mov word [0x100bd0d8], ax
fld dword [0x1005cfdc]
mov dword [0x100bd0b8], edi
fstp dword [0x100bd0d0]
mov byte [0x100bd0da], al
fld dword [0x1005cfd0]
mov dword [0x100bd11c], eax
fstp dword [0x100bd104]
mov word [0x100bd120], ax
fld dword [0x1005cd58]
mov dword [0x100bd100], 0xc943
fstp dword [0x100bd108]
mov byte [0x100bd122], al
fld dword [0x1005c8b4]
fst dword [0x100bd10c]
fstp dword [0x100bd110]
fld dword [0x1005cfcc]
fstp dword [0x100bd114]
fld dword [0x1005cfc8]
fstp dword [0x100bd118]
call fcn.10053c00
push 0x1000b270
push 0x4d6c3e
call fcn.10053c00
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x40
push 4
xor ebx, ebx
push 0x4d7530
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000b186
mov ecx, 0x4d7530
mov dword [ecx], edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 4
push ecx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000b18c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x4d7564
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000b1bd
mov edx, 0x4d7564
mov dword [edx], edi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 4
push edx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000b1c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x4053a3
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000b1f4
mov eax, 0x4053a3
mov dword [eax], edi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push eax
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000b1fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x401d30
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000b22b
mov ecx, 0x401d30
mov dword [ecx], edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 4
push ecx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000b231
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x4053d4
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000b262
mov edx, 0x4053d4
mov byte [edx], bl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 1
push edx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000b268
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cb10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
fld dword [0x100bcf5c]
push ebx
push esi
push edi
call fcn.100569f0
fld dword [0x100bcf60]
mov esi, eax
call fcn.100569f0
fld dword [0x100bcf54]
mov edi, eax
call fcn.100569f0
fld dword [0x100bcf58]
mov ebx, eax
call fcn.100569f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000cb9e
cmp dword [ebp + 8], 0x201
jne 0x1000cb71
pop edi
pop esi
mov byte [0x100bcf70], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bcf6c]
mov byte [0x100bcf70], 0
cmp eax, 0x1f4
jb 0x1000cd4d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100bcf6c], eax
pop ebx
pop ebp
ret 8
fld dword [0x100bcfa4]
call fcn.100569f0
fld dword [0x100bcfa8]
mov esi, eax
call fcn.100569f0
fld dword [0x100bcf9c]
mov edi, eax
call fcn.100569f0
fld dword [0x100bcfa0]
mov ebx, eax
call fcn.100569f0
push eax
push ebx
push edi
push esi
mov ecx, 0x790b10
call ecx
add esp, 0x10
test al, al
je 0x1000cc26
cmp dword [ebp + 8], 0x201
jne 0x1000cbf9
pop edi
pop esi
mov byte [0x100bcfb8], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bcfb4]
mov byte [0x100bcfb8], 0
cmp eax, 0x1f4
jb 0x1000cd4d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100bcfb4], eax
pop ebx
pop ebp
ret 8
fld dword [0x100bcfec]
call fcn.100569f0
fld dword [0x100bcff0]
mov esi, eax
call fcn.100569f0
fld dword [0x100bcfe4]
mov edi, eax
call fcn.100569f0
fld dword [0x100bcfe8]
mov ebx, eax
call fcn.100569f0
push eax
push ebx
push edi
push esi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1000ccae
cmp dword [ebp + 8], 0x201
jne 0x1000cc81
pop edi
pop esi
mov byte [0x100bd000], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bcffc]
mov byte [0x100bd000], 0
cmp eax, 0x1f4
jb 0x1000cd4d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100bcffc], eax
pop ebx
pop ebp
ret 8
mov eax, 0x94
mov ecx, 0x100ba618
call fcn.10026cf0
test al, al
je 0x1000cd01
cmp dword [ebp + 8], 0x201
jne 0x1000ccd8
pop edi
pop esi
mov byte [0x100bd048], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bd044]
mov byte [0x100bd048], 0
cmp eax, 0x1f4
jb 0x1000cd4d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100bd044], eax
pop ebx
pop ebp
ret 8
mov eax, 0x95
mov ecx, 0x100ba618
call fcn.10026cf0
test al, al
je 0x1000cd4d
cmp dword [ebp + 8], 0x201
jne 0x1000cd2b
pop edi
pop esi
mov byte [0x100bd090], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bd08c]
mov byte [0x100bd090], 0
cmp eax, 0x1f4
jb 0x1000cd4d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bd08c], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8