joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10076370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b6a54
call esi
mov eax, 0x10077320
mov byte [0x4b6a54], 0xe9
sub eax, 0x4b6a59
mov dword [0x4b6a55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b6a54
call esi
sub esp, 0x28
mov ecx, 0x100762d0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x100763d7
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x100762d0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154dd0
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x10076420
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b7f3c
call esi
mov eax, 0x10076320
mov byte [0x4b7f3c], 0xe9
sub eax, 0x4b7f41
mov dword [0x4b7f3d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b7f3c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b78a4
call esi
mov eax, 0x10076330
mov byte [0x4b78a4], 0xe9
sub eax, 0x4b78a9
mov dword [0x4b78a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b78a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b81c4
call esi
mov eax, 0x10076340
mov byte [0x4b81c4], 0xe9
sub eax, 0x4b81c9
mov dword [0x4b81c5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b81c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b8330
call esi
mov eax, 0x10076350
mov byte [0x4b8330], 0xe9
sub eax, 0x4b8335
mov dword [0x4b8331], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b8330
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b83d4
call esi
mov eax, 0x10076360
mov byte [0x4b83d4], 0xe9
sub eax, 0x4b83d9
mov dword [0x4b83d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b83d4
call esi
pop esi
add esp, 0x10
ret

Function at 0x10076820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d78cc
call esi
mov eax, 0x10076780
mov byte [0x4d78cc], 0xe9
sub eax, 0x4d78d1
mov dword [0x4d78cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d78cc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d797c
call esi
mov eax, 0x10076800
mov byte [0x4d797c], 0xe9
sub eax, 0x4d7981
mov dword [0x4d797d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d797c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d650c
call esi
mov eax, 0x10076810
mov byte [0x4d650c], 0xe9
sub eax, 0x4d6511
mov dword [0x4d650d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d650c
call esi
pop esi
pop ecx
ret
Function at 0x100786b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10079900
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c1a64
call esi
mov eax, 0x10077ea0
mov byte [0x4c1a64], 0xe9
sub eax, 0x4c1a69
mov dword [0x4c1a65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c1a64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4bfb08
call esi
mov eax, 0x10078680
mov byte [0x4bfb08], 0xe9
sub eax, 0x4bfb0d
mov dword [0x4bfb09], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4bfb08
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c59a4
call esi
mov eax, 0x10078690
mov byte [0x4c59a4], 0xe9
sub eax, 0x4c59a9
mov dword [0x4c59a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c59a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c4634
call esi
mov eax, 0x100786a0
mov byte [0x4c4634], 0xe9
sub eax, 0x4c4639
mov dword [0x4c4635], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c4634
call esi
pop esi
pop ecx
ret
Function at 0x10079900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
call fcn.1005f530
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.TownMapHotkeys
mov edx, str.Debugging
mov ecx, str..ddraw.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x10079978
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100799aa
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
jmp 0x100799aa
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100799a6
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
test esi, esi
jne 0x100799fc
cmp byte [0x10174f84], 0
je 0x100799f5
test byte [0x10174f88], 0x10
je 0x100799f5
mov edx, str.Applying_town_map_hotkeys_fix_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100799f5
mov edx, str.Applying_town_map_hotkeys_fix_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov byte [0x1017503d], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4c1e54
call esi
mov eax, 0x100798e0
mov byte [0x4c1e54], 0xe9
sub eax, 0x4c1e59
mov dword [0x4c1e55], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x4c1e54
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4bfe10
call esi
mov eax, 0x100798f0
mov byte [0x4bfe10], 0xe9
sub eax, 0x4bfe15
mov dword [0x4bfe11], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x4bfe10
call esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10079b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0x436c8e
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x437045
push eax
push ecx
mov ecx, 0x10079a80
mov dword [esp + 0x20], 0x43769b
mov dword [esp + 0x24], 0x43800a
mov dword [esp + 0x28], 0x41e027
mov dword [esp + 0x2c], 0x41ec22
call fcn.100122c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x41d105
call esi
mov eax, 0x10079af0
sub eax, 0x41d109
mov dword [0x41d105], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x41d105
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x43ae93
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x43af59
push eax
push ecx
mov ecx, 0x10079b00
call fcn.100122c0
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43cb5d
call esi
mov eax, 0x10079b80
sub eax, 0x43cb61
mov dword [0x43cb5d], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43cb5d
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007ac90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, ecx
push edi
mov edi, edx
xor ebx, ebx
sub ebp, edi
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x10]
cmova ebp, ecx
test ebp, ebp
je 0x1007ace4
push esi
mov esi, dword [edi]
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
mov dword [esi], 0x1013cef8
push eax
push dword [esp + 0x18]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x1007acb1
pop esi
pop edi
pop ebp
pop ebx
ret 4

Function at 0x1007aef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fb3
call esi
mov eax, 0x1007acf0
sub eax, 0x443fb7
mov dword [0x443fb3], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x443fb3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44401e
call esi
mov eax, 0x1007ad90
sub eax, 0x444022
mov dword [0x44401e], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44401e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x444078
call esi
mov eax, 0x1007aee0
sub eax, 0x44407c
mov dword [0x444078], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x444078
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
mov dword [0x443fef], 0xfffd516d
push eax
push dword [esp + 8]
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x443fec
call esi
mov eax, 0xca89
mov word [0x443fec], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x443fec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x444039
call esi
mov dword [0x444039], 0x441f0f
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x444039
call esi
pop esi
pop ecx
ret
Function at 0x1007b230
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40
mov dword [esp], ecx
push ebx
push ebp
mov ebp, edx
mov edx, ecx
push esi
push edi
test cl, 3
je 0x1007b249
and edx, 0xfffffffc
add edx, 4
mov edi, dword [esp + 0x5c]
mov eax, edx
sub eax, ecx
imul edx, ebp
mov dword [esp + 0x14], eax
mov eax, 0x4d42
mov word [esp + 0x18], ax
push edi
push 1
push 0xe
mov dword [esp + 0x2e], 0x436
mov dword [esp + 0x34], 0x28
lea eax, [edx + 0x436]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x26], eax
xor eax, eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], 0x80001
mov dword [esp + 0x4c], edx
mov dword [esp + 0x58], 0x100
call fcn.100f607a
push edi
push 1
lea eax, [esp + 0x40]
push 0x28
push eax
call fcn.100f607a
mov esi, dword [esp + 0x78]
add esp, 0x20
add esi, 2
mov ebx, 0x100
nop dword [eax + eax]
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
push edi
shl ecx, 8
or ecx, eax
lea eax, [esp + 0x60]
push 1
shl ecx, 2
push 4
push eax
mov dword [esp + 0x6c], ecx
call fcn.100f5f01
add esp, 0x10
lea esi, [esi + 3]
sub ebx, 1
jne 0x1007b2e0
mov eax, dword [esp + 0x10]
lea ebx, [ebp - 1]
imul ebx, eax
add ebx, dword [esp + 0x54]
test ebp, ebp
jle 0x1007b35a
push edi
push eax
push 1
push ebx
dec ebp
call fcn.100f5f01
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
je 0x1007b350
mov esi, eax
push edi
push 0
call fcn.100ef585
add esp, 8
sub esi, 1
jne 0x1007b340
mov eax, dword [esp + 0x10]
sub ebx, eax
test ebp, ebp
jg 0x1007b328
push edi
call fcn.100f22da
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
Function at 0x1007b7e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push edi
push 9
mov ebx, edx
mov edi, ecx
push 0
push str.__restart
mov ecx, ebx
call fcn.10007920
cmp eax, 0xffffffff
je 0x1007b826
push 1
mov edx, edi
lea ecx, [esp + 0xc]
call fcn.1007b420
mov edx, dword [esp + 0x1c]
cmp edx, 0x10
jb 0x1007b826
mov ecx, dword [esp + 8]
inc edx
push 1
call fcn.1000d8e0
cmp dword [0x4e4480], 0x278805c7
je 0x1007b8a7
push str.f2_res.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1007b8a7
cmp byte [0x10174f82], 0
mov ecx, str.The_enabled_High_Resolution_Patch_by_Mash_is_no_longer_supported__it_will_be_automatically_disabled__n_nNote:_sfall_has_its_own_High_Resolution_patch__which_is_compatible_with_Mash_High_Resolution_Patch.
push 0x2030
push str.SFALL:_High_Resolution_patch
mov eax, 0x101248b0
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
call fcn.1007b550
test al, al
jne 0x1007b89f
cmp byte [0x10174f82], 0
mov ecx, str.Failed_to_disable_the_High_Resolution_Patch_by_Mash._nDo_it_manually_or_delete_the_file_f2_res.dll_from_the_game_folder.
push 0x2010
push str.Error_disable_HRP_by_Mash
mov eax, 0x10124a70
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007cca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x1013cd3c]
push esi
cmp dword [eax], 0xffffffff
je 0x1001c622
cmp dword [0x518f14], 0
jne 0x1001c622
mov ecx, dword [0x519024]
call fcn.10075510
mov esi, dword [0x10175044]
test esi, esi
je 0x1001c618
mov ecx, dword [esi]
call fcn.10075510
mov ecx, dword [esi + 4]
call fcn.10075510
mov dword [0x518f14], 1
pop esi
jmp fcn.10044120
cmp dword [0x10143a5c], 0
push esi
je 0x1007ccde
mov dl, byte [0x10155921]
test dl, dl
jne 0x1007ccbd
cmp dword [0x518f14], 0
jne 0x1007ccde
lea eax, [ecx - 0x10]
cmp eax, 2
ja 0x1007cd0c
test dl, dl
jne 0x1007ccde
mov esi, dword [0x1015eec4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
jne 0x1007cce0
mov dword [0x1015eec4], eax
pop esi
ret
mov edx, eax
mov ecx, eax
sub edx, esi
sub ecx, esi
cmp eax, esi
cmovae ecx, edx
cmp ecx, 0xfa
jbe 0x1007ccde
mov dword [0x1015eec4], 0
mov byte [0x10155921], 1
pop esi
jmp 0x1001c5e0
pop esi
jmp fcn.1007cd20
Function at 0x1007d460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47d52a
call esi
mov eax, 0x1007d3d0
sub eax, 0x47d52e
mov dword [0x47d52a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47d52a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47ed8d
call esi
mov eax, 0x1007d3e0
sub eax, 0x47ed91
mov dword [0x47ed8d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47ed8d
call esi
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x47cc0f
lea ecx, [esp + 4]
mov dword [esp + 8], 0x47be3d
push eax
push ecx
mov ecx, 0x1007d400
call fcn.100122c0
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47c628
call esi
mov eax, 0x1007d420
sub eax, 0x47c62c
mov dword [0x47c628], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47c628
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47d430
call esi
mov eax, 0x1007d440
sub eax, 0x47d434
mov dword [0x47d430], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47d430
call esi
pop esi
add esp, 8
ret

Function at 0x1007de30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 8], 0x41b979
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x43f560
push eax
push ecx
mov ecx, 0x1007de00
mov dword [esp + 0x18], 0x490005
mov dword [esp + 0x1c], 0x490961
call fcn.100122c0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x490eac
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x491546
push eax
push ecx
mov ecx, 0x1007de10
call fcn.100122c0
mov esi, dword [0x1013cf00]
lea eax, [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x49042a
call edi
lea eax, [esp + 8]
mov dword [0x49042a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x49042a
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x490436
call edi
lea eax, [esp + 8]
mov dword [0x490436], esi
push eax
push dword [esp + 0xc]
push 4
push 0x490436
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x49075f
call edi
lea eax, [esp + 8]
mov dword [0x49075f], esi
push eax
push dword [esp + 0xc]
push 4
push 0x49075f
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007e490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10143a74]
sub esp, 8
test eax, eax
jns 0x1007e4a8
mov dword [0x10143a74], 0
jmp 0x1007e4b7
mov ecx, 2
cmp eax, ecx
cmovg eax, ecx
mov dword [0x10143a74], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44e7e4
call edi
mov eax, 0x1007e330
sub eax, 0x44e7e8
mov dword [0x44e7e4], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44e7e4
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44ea76
call edi
mov eax, 0x1007e410
sub eax, 0x44ea7a
mov dword [0x44ea76], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44ea76
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
mov dword [0x4877d0], 0x1007e0d0
push eax
push dword [esp + 0xc]
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487813
call edi
lea eax, [esp + 8]
mov dword [0x487813], 0x1007e170
push eax
push dword [esp + 0xc]
push 4
push 0x487813
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4f5d40
call edi
mov eax, 0x1007e0c0
mov byte [0x4f5d40], 0xe8
sub eax, 0x4f5d45
mov dword [0x4f5d41], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4f5d40
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x48738f
call edi
mov eax, fcn.1007b370
sub eax, 0x487393
mov dword [0x48738f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x48738f
call edi
mov esi, dword [0x1013cf00]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487580
call edi
lea eax, [esp + 8]
mov dword [0x487580], esi
push eax
push dword [esp + 0xc]
push 4
push 0x487580
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4875bf
call edi
mov eax, 0x1007e2d0
sub eax, 0x4875c3
mov dword [0x4875bf], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4875bf
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
mov byte [0x4875c5], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x44e6b2
call edi
mov eax, 0x1007e2e0
mov byte [0x44e6b2], 0xe8
sub eax, 0x44e6b7
mov dword [0x44e6b3], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x44e6b2
call edi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x44eac9
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x44eadd
push eax
push ecx
mov ecx, 0x1007e300
call fcn.10012340
pop edi
pop esi
add esp, 8
ret
Function at 0x100837d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fa1e
call edi
mov eax, 0x10083730
sub eax, 0x43fa22
mov dword [0x43fa1e], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fa1e
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43f805
call edi
mov eax, 0x100837c0
sub eax, 0x43f809
mov dword [0x43f805], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43f805
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
mov dword [0x44065a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440024
call edi
mov eax, 0x100831d0
sub eax, 0x440028
mov dword [0x440024], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x440024
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44004f
call edi
mov eax, fcn.10083200
sub eax, 0x440053
mov dword [0x44004f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44004f
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44012a
call edi
mov eax, 0x100833e0
sub eax, 0x44012e
mov dword [0x44012a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44012a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44063a
call edi
mov eax, 0x10083520
sub eax, 0x44063e
mov dword [0x44063a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44063a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fde4
call edi
mov eax, 0x100835b0
sub eax, 0x43fde8
mov dword [0x43fde4], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fde4
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc81
call edi
mov eax, 0x10083550
sub eax, 0x43fc85
mov dword [0x43fc81], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fc81
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
mov byte [0x43fc75], 0x56
push eax
push dword [esp + 0xc]
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440072
call edi
lea eax, [esp + 8]
mov dword [0x440072], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x440072
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc94
call edi
lea eax, [esp + 8]
mov dword [0x43fc94], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x43fc94
call edi
pop edi
pop esi
pop ecx
ret

Function at 0x10083f60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 4
push 0x442b0c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10083f50
sub eax, 0x442b10
mov dword [0x442b0c], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x442b0c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret