joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010d070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x1010d09e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
fld qword [ebp + 8]
lea ecx, [ebp - 8]
fstp qword [esi]
push ecx
push edx
push 8
push esi
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x1010d093
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1010d100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [0xe8c578]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1010d15e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x1010d180
mov ecx, dword [0xe8c578]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov bl, 1
call fcn.1010d190
mov edi, 0x10234779
call fcn.1010d2d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0xe8c578]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor bl, bl
call fcn.1010d190
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010d5b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
fld dword [ebp + 0x18]
push ecx
fstp dword [esp]
call fcn.1010d550
fstp dword [ebp - 8]
push ecx
fld dword [ebp + 0x1c]
fmul qword [0x1013f6e8]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.1010d550
fstp dword [ebp - 4]
sub esp, 0x10
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.100bb960
test al, al
je 0x1010d706
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x1c]
fdiv dword [ebp - 4]
mov ecx, 0x8000
push ecx
fldz
fst dword [esp]
fxch st(1)
push 1
push 1
sub esp, 0x20
test cx, ax
je 0x1010d68b
fst dword [ebp + 0x1c]
movzx edx, byte [esi + 2]
fld dword [ebp + 0x1c]
mov eax, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], edx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call eax
jmp 0x1010d6e2
fst dword [ebp + 0x1c]
movzx ecx, byte [esi + 1]
fld dword [ebp + 0x1c]
mov edx, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], ecx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call edx
add esp, 0x30
push 1
mov eax, 0x791050
call eax
add esp, 4
test al, al
je 0x1010d774
push 0x11920ab8
call dword [ebp + 0x20]
add esp, 4
mov esp, ebp
pop ebp
ret 0x1c
fld dword [ebp + 0x1c]
push ecx
fdiv dword [ebp - 4]
movzx ecx, byte [esi]
mov edx, 0x637c60
fldz
fst dword [esp]
fxch st(1)
fst dword [ebp + 0x1c]
push 1
fld dword [ebp + 0x1c]
push 1
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], ecx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call edx
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1010d780
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
fld dword [ebp + 0x18]
push esi
push ecx
fstp dword [esp]
mov esi, eax
call fcn.1010d550
fstp dword [ebp - 8]
fld dword [ebp + 0x1c]
push ecx
fmul qword [0x1013f6e8]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.1010d550
fstp dword [ebp - 4]
sub esp, 0x10
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.100bb960
test al, al
je 0x1010d8f4
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x1c]
fdiv dword [ebp - 4]
mov ecx, 0x8000
push ecx
fldz
fst dword [esp]
fxch st(1)
push 1
push 1
sub esp, 0x20
test cx, ax
je 0x1010d85e
fst dword [ebp + 0x1c]
movzx edx, byte [esi + 2]
fld dword [ebp + 0x1c]
mov eax, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], edx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call eax
jmp 0x1010d8b5
fst dword [ebp + 0x1c]
movzx ecx, byte [esi + 1]
fld dword [ebp + 0x1c]
mov edx, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], ecx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call edx
add esp, 0x30
push 1
mov eax, 0x791050
call eax
add esp, 4
test al, al
je 0x1010d962
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x10a771d4]
add ecx, 0x12c
cmp eax, ecx
jbe 0x1010d962
call esi
mov dword [0x10a771d4], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0x18
fld dword [ebp + 0x1c]
push ecx
fdiv dword [ebp - 4]
movzx edx, byte [esi]
mov eax, 0x637c60
fldz
fst dword [esp]
fxch st(1)
fst dword [ebp + 0x1c]
push 1
fld dword [ebp + 0x1c]
push 1
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], edx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call eax
add esp, 0x30
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1010d970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
fld dword [ebp + 0x18]
push ecx
fstp dword [esp]
call fcn.1010d550
fstp dword [ebp - 8]
push ecx
fld dword [ebp + 0x1c]
fmul qword [0x1013f6e8]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.1010d550
fstp dword [ebp - 4]
sub esp, 0x10
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.100bb960
test al, al
je 0x1010dad3
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x1c]
fdiv dword [ebp - 4]
mov ecx, 0x8000
push ecx
fldz
fst dword [esp]
fxch st(1)
push 1
push 1
sub esp, 0x20
test cx, ax
je 0x1010da4f
fst dword [ebp + 0x1c]
movzx edx, byte [esi + 2]
fld dword [ebp + 0x1c]
mov eax, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], edx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7e4b
call eax
jmp 0x1010daaa
fst dword [ebp + 0x1c]
movzx ecx, byte [esi + 1]
fld dword [ebp + 0x1c]
mov edx, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], ecx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7e4b
call edx
add esp, 0x30
push 1
mov eax, 0x791050
call eax
add esp, 4
test al, al
je 0x1010db45
mov dword [0x11920ab8], edi
mov dword [0x107b762c], edi
mov esp, ebp
pop ebp
ret 0x18
fld dword [ebp + 0x1c]
push ecx
fdiv dword [ebp - 4]
movzx ecx, byte [esi]
mov edx, 0x637c60
fldz
fst dword [esp]
fxch st(1)
fst dword [ebp + 0x1c]
push 1
fld dword [ebp + 0x1c]
push 1
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [ebp - 8]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
mov dword [ebp + 0x1c], ecx
fild dword [ebp + 0x1c]
fmulp st(1)
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7e4b
call edx
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1010db50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
fld dword [ebp + 0x18]
push ecx
fstp dword [esp]
call fcn.1010d550
fstp dword [esp + 4]
push ecx
fild dword [ebp + 0x20]
fmul dword [ebp + 0x1c]
fstp dword [esp + 4]
fld dword [esp + 4]
fstp dword [esp]
call fcn.1010d550
fstp dword [esp]
sub esp, 0x10
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.100c31a0
test al, al
je 0x1010dcab
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x1c]
fdiv dword [esp]
mov ecx, 0x8000
push ecx
fldz
fst dword [esp]
fxch st(1)
push 1
push 1
sub esp, 0x20
test cx, ax
je 0x1010dc40
fst dword [esp + 0x2c]
movzx edx, byte [esi + 2]
fld dword [esp + 0x2c]
mov eax, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 0x18]
mov dword [esp + 0x30], edx
fild dword [esp + 0x30]
fmulp st(1)
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call eax
add esp, 0x30
mov al, 1
mov esp, ebp
pop ebp
ret 0x1c
fst dword [esp + 0x2c]
movzx ecx, byte [esi + 1]
fld dword [esp + 0x2c]
mov edx, 0x637c60
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 0x18]
mov dword [esp + 0x30], ecx
fild dword [esp + 0x30]
fmulp st(1)
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call edx
add esp, 0x30
mov al, 1
mov esp, ebp
pop ebp
ret 0x1c
fld dword [ebp + 0x1c]
push ecx
fdiv dword [esp + 4]
movzx eax, byte [esi]
mov ecx, 0x637c60
fldz
fst dword [esp]
fxch st(1)
fst dword [esp + 4]
push 1
fld dword [esp + 8]
push 1
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x18]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 0x18]
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
fmulp st(1)
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x14]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push edi
call ecx
add esp, 0x30
xor al, al
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1010fa60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
push 0x101103d0
push 0x77f822
or bl, 0xff
mov dword [0x10a723b8], eax
mov byte [0x10a723a4], al
mov dword [0x10a723ac], ecx
mov dword [0x10a723b4], ecx
mov dword [0x10a723a8], ecx
mov dword [0x10a736fc], eax
mov dword [0x10a73700], eax
mov dword [0x10a73704], eax
mov byte [0x10a73708], al
mov dword [0x10a723bc], eax
mov dword [0x10a723c0], eax
mov byte [0x10a723c4], al
call fcn.10110d60
push 0x101103a0
push 0x520ecf
or bl, 0xff
call fcn.10110d60
push 0x101103a0
push 0x520f1f
or bl, 0xff
call fcn.10110d60
push 0x101103a0
push 0x63e743
or bl, 0xff
call fcn.10110d60
push 0x101103a0
push 0x640eb2
or bl, 0xff
call fcn.10110d60
push 0x101103a0
push 0x7d2dd9
or bl, 0xff
call fcn.10110d60
push 0x101103a0
push 0x7e6c0f
or bl, 0xff
call fcn.10110d60
push 0x101103a0
push 0x84aef7
or bl, 0xff
call fcn.10110d60
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x40
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1010fe40
push 5
sub eax, 0x57d518
xor ebx, ebx
push 0x57d513
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1010fb9d
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x57d513
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x57d513
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1010fb9f
call edi
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x1010fe40
push 5
sub ecx, 0x57d504
push 0x57d4ff
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1010fbef
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x57d4ff
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x57d4ff
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1010fbf1
call edi
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10110c50
push 5
sub edx, 0x588516
push 0x588511
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1010fc41
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x588511
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x588511
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1010fc43
call edi
cmp dword [0x10234b30], ebx
jne 0x1010fcb0
mov byte [0x10a73740], bl
push 0x1010fa30
push 0x59a9b1
mov bl, 0xe8
call fcn.10110d60
push 0x1010fa30
push 0x59af48
call fcn.10110d60
push 0x1010fa30
push 0x59b20a
call fcn.10110d60
push 0x1010fa30
push 0x59b23d
call fcn.10110d60
push 0x1010fa30
push 0x59a420
call fcn.10110d60
push 0x1010fa30
push 0x59a844
call fcn.10110d60
add esp, 0x30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010fea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0xe609e8], 5
mov eax, dword [0x7bc4f04]
jne 0x1010ff0a
mov al, byte [eax + 0x13]
push esi
cmp al, 3
je 0x1010fedc
cmp al, 0x1b
je 0x1010fedc
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x649e27
call esi
mov byte [0x649e27], 0xd
jmp 0x1010fef8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x649e27
call esi
mov byte [0x649e27], 1
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x649e27
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10110c70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push esi
call edi
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push eax
push 1
push esi
mov byte [esi], cl
call edi
pop edi
pop esi
pop ebp
ret

Function at 0x10110ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push esi
call edi
mov eax, dword [ebp - 4]
mov cx, word [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 2
push esi
mov word [esi], cx
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10110cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10110d00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 8]
mov edx, dword [ebp - 4]
fstp dword [esi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push esi
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10110d30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 8
push esi
call edi
fld qword [ebp + 0xc]
mov edx, dword [ebp + 8]
fstp qword [esi]
lea ecx, [ebp + 8]
push ecx
push edx
push 8
push esi
call edi
pop edi
pop esi
pop ebp
ret

Function at 0x10110d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
cmp bl, 0xff
je 0x10110d81
mov byte [esi], bl
mov ecx, dword [ebp + 0xc]
sub ecx, esi
sub ecx, 5
lea edx, [ebp - 4]
push edx
mov dword [esi + 1], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10110da0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10110de0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x90
push edi
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push esi
push edi
call ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10110e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebx + 5]
push ecx
call dword [sym.imp.MSVCR100.dll_malloc]
push ebx
mov esi, eax
push edi
push esi
call sub.MSVCR100.dll_memcpy
mov edx, edi
sub edx, esi
mov byte [esi + ebx], 0xe9
sub edx, 5
mov dword [esi + ebx + 1], edx
lea eax, [ebx - 5]
push eax
sub esi, edi
lea ecx, [edi + 5]
push 0x90
sub esi, 5
push ecx
mov byte [edi], 0xe9
mov dword [edi + 1], esi
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 4]
add esp, 0x1c
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret