joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100696b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 4
mov ebx, 0x7e7827
call fcn.1010cff0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10069430
push 5
sub eax, 0x7e782c
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10069714
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1006971a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa
mov ebx, 0x5f479e
call fcn.1010cff0
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10069500
push 5
sub ecx, 0x5f47a3
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10069770
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x10069776
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006cd00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x118d0465], 0
mov edx, eax
je 0x1006cd6c
mov eax, 0x228
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x1006cd6c
cmp dword [ebp + 8], 0x201
jne 0x1006cd3f
mov al, 1
mov byte [0x118d04b8], al
pop esi
pop ebp
ret 4
sub edx, dword [0x118d04b4]
mov byte [0x118d04b8], 0
cmp edx, 0x1f4
jb 0x1006cd6c
call esi
mov dword [0x118d04b4], eax
mov byte [0x118d0465], 0
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4
Function at 0x1006ce90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x74]
push ecx
xor edi, edi
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWAREWebzenMuConfig
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1006d035
push 0x31
lea edx, [ebp - 0x6b]
push edi
push edx
mov dword [ebp - 0x70], 0xb
mov dword [0x108c68c4], edi
mov byte [ebp - 0x6c], al
call sub.MSVCR100.dll_memset
push 0x31
lea eax, [ebp - 0x37]
push edi
push eax
mov byte [ebp - 0x38], 0
call sub.MSVCR100.dll_memset
add esp, 0x18
push ebx
push esi
lea ecx, [ecx]
lea edx, [ebp - 0x6c]
test edi, edi
je 0x1006cf28
lea esi, [edi + 1]
push esi
push str.ID__d
call fcn.1006e580
push esi
push str.PW__d
lea edx, [ebp - 0x38]
call fcn.1006e580
add esp, 0x10
jmp 0x1006cf42
push 0x10135e5c
call fcn.1006e580
push 0x10135e60
lea edx, [ebp - 0x38]
call fcn.1006e580
add esp, 8
mov ecx, edi
imul ecx, ecx, 0xb
lea edx, [ebp - 0x70]
push edx
lea esi, [ecx + 0x108c6bd4]
mov ecx, dword [ebp - 0x74]
push esi
push 0
push 0
lea eax, [ebp - 0x6c]
push eax
push ecx
mov dword [ebp - 0x70], 0xb
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x70]
jne 0x1006cfcf
cmp eax, 1
jb 0x1006cfcf
mov edx, edi
imul edx, edx, 0x15
lea eax, [ebp - 0x70]
push eax
lea ebx, [edx + 0x108c6b68]
mov edx, dword [ebp - 0x74]
push ebx
push 0
push 0
lea ecx, [ebp - 0x38]
push ecx
push edx
mov dword [ebp - 0x70], 0x15
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x70]
test eax, eax
jne 0x1006cfb4
cmp ecx, 1
jb 0x1006cfb4
inc dword [0x108c68c4]
jmp 0x1006cff8
xor eax, eax
push ecx
mov dword [esi], eax
mov dword [esi + 4], eax
push eax
mov word [esi + 8], ax
push ebx
mov byte [esi + 0xa], al
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x1006cff8
push eax
push 0
push esi
call sub.MSVCR100.dll_memset
mov eax, edi
imul eax, eax, 0x15
xor ecx, ecx
add esp, 0xc
add eax, 0x108c6b68
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], cl
inc edi
cmp edi, 5
jl 0x1006cf00
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
push 0x10150f10
push 0
push 0
push str.SavePass
push ecx
mov dword [ebp - 0x70], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop esi
pop ebx
test eax, eax
je 0x1006d035
mov dword [0x10150f10], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x1006d050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
mov ebx, dword [esi + 0x10]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREWebzenMuConfig
push connect
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1006d095
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x10
cmp dword [esi + 0x14], eax
jb 0x1006d0a1
mov esi, dword [esi]
cmp dword [edi + 0x14], eax
jb 0x1006d0aa
mov eax, dword [edi]
jmp 0x1006d0ac
mov eax, edi
mov edx, dword [ebp - 4]
push ebx
push esi
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006e3d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40c98c
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x40c98c], 2
mov edx, dword [ebp - 4]
push edx
push 4
push 0x40c98c
call esi
push 0x1006e2a0
push 0x4d7602
mov bl, 0xe8
call fcn.10110d60
push 0x1006d960
push 0x40b331
call fcn.10110d60
push 0x1006d7d0
push 0x40ada2
call fcn.10110d60
push 0x1006d8f0
push 0x40b2e2
call fcn.10110d60
push 0x1006e1c0
push 0x40c3af
call fcn.10110d60
push 0x1006e1c0
push 0x40c40b
call fcn.10110d60
push 0x1006e1c0
push 0x40c45f
call fcn.10110d60
push 0x1006e1a0
push 0x40b422
call fcn.10110d60
add esp, 0x40
push 0x1006e1a0
push 0x40b47c
call fcn.10110d60
push 0x1006d9b0
push 0x40b3f1
call fcn.10110d60
push 0x1006e280
push 0x40ab50
call fcn.10110d60
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40af10
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x40af10], 0x64
mov edx, dword [ebp - 4]
push edx
push 4
push 0x40af10
call esi
push 0x1006e380
push 0x483711
call fcn.10110d60
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd2300c
call esi
lea ecx, [ebp - 4]
mov dword [0xd2300c], 0x1006e0f0
mov edx, dword [ebp - 4]
push ecx
push edx
push 4
push 0xd2300c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd23010
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0xd23010], 0x1006da20
mov edx, dword [ebp - 4]
push edx
push 4
push 0xd23010
call esi
push 0x1006e150
push 0x40b1d4
call fcn.10110d60
push 0x1006e0d0
push 0x40b400
call fcn.10110d60
push 0x1006e0d0
push 0x40b44f
call fcn.10110d60
add esp, 0x18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006f6d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
xor edi, edi
push 0x61647b
mov bl, 0x31
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1006f714
mov ecx, 0x61647b
mov byte [ecx], bl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 1
push ecx
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1006f71a
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x1006f530
push 5
sub ecx, 0x551ec4
mov bl, 0xe8
push 0x551ebf
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1006f76b
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x551ebf
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x551ebf
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1006f771
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x1006f860
push 5
sub edx, 0x4d9ce0
push 0x4d9cdb
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1006f7c0
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x4d9cdb
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x4d9cdb
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1006f7c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10070ca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edx, eax
mov eax, 0x39
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10070d20
cmp dword [ebp + 8], 0x201
jne 0x10070cdb
mov al, 1
mov byte [0x118c624c], al
pop esi
mov esp, ebp
pop ebp
ret 4
sub edx, dword [0x118c6248]
mov byte [0x118c624c], 0
cmp edx, 0x1f4
jb 0x10070d20
call esi
mov dword [0x118c6248], eax
lea eax, [ebp - 8]
mov ecx, 8
push eax
mov dword [ebp - 8], 0x79508c1
mov dword [ebp - 4], 3
call fcn.10100800
add esp, 4
mov dword [0x116dcb20], 1
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10070d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edx, eax
mov eax, 0x3a
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10070d8c
cmp dword [ebp + 8], 0x201
jne 0x10070d66
mov al, 1
mov byte [0x118c62a0], al
pop esi
pop ebp
ret 4
sub edx, dword [0x118c629c]
mov byte [0x118c62a0], 0
cmp edx, 0x1f4
jb 0x10070d8c
call esi
mov dword [0x118c629c], eax
mov dword [0x116dcb20], 2
xor al, al
pop esi
pop ebp
ret 4
Function at 0x10070da0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edx, eax
mov eax, 0x3b
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10070e43
cmp dword [ebp + 8], 0x201
jne 0x10070dde
mov eax, 1
mov byte [0x118c62f4], al
pop esi
mov esp, ebp
pop ebp
ret 4
sub edx, dword [0x118c62f0]
mov byte [0x118c62f4], 0
cmp edx, 0x1f4
jb 0x10070e43
call esi
mov ecx, dword [0x116dcb20]
mov dword [0x118c62f0], eax
mov eax, 1
cmp ecx, eax
jne 0x10070e19
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x69508c1
push eax
jmp 0x10070e2c
cmp ecx, 2
jne 0x10070e39
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x89508c1
mov dword [ebp - 4], eax
push edx
mov ecx, 8
call fcn.10100800
add esp, 4
mov dword [0x116dcb20], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10070e50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edx, eax
mov eax, 0x3c
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10070eac
cmp dword [ebp + 8], 0x201
jne 0x10070e86
mov al, 1
mov byte [0x118c6348], al
pop esi
pop ebp
ret 4
sub edx, dword [0x118c6344]
mov byte [0x118c6348], 0
cmp edx, 0x1f4
jb 0x10070eac
call esi
mov dword [0x118c6344], eax
mov dword [0x116dcb20], 0
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10070ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x118c60a9], 0
mov edx, eax
je 0x10070f2c
mov eax, 0x36
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10070f2c
cmp dword [ebp + 8], 0x201
jne 0x10070eff
mov al, 1
mov byte [0x118c6150], al
pop esi
pop ebp
ret 4
sub edx, dword [0x118c614c]
mov byte [0x118c6150], 0
cmp edx, 0x1f4
jb 0x10070f2c
call esi
mov dword [0x118c614c], eax
mov byte [0x118c60a9], 0
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10070f40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c6398]
cmp byte [0x118c60a9], 0
mov edx, eax
je 0x10070fad
mov eax, 0x3d
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10070fad
cmp dword [ebp + 8], 0x201
jne 0x10070f8d
mov eax, 1
mov byte [0x118c639c], al
mov dword [0xe8cb3c], eax
pop esi
pop ebp
ret 4
mov byte [0x118c639c], 0
mov dword [0xe8cb3c], 0
cmp edx, 0x1f4
jb 0x10070fad
call esi
mov dword [0x118c6398], eax
xor al, al
pop esi
pop ebp
ret 4
Function at 0x100711d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10135c08
push str.DataLocalMuunData.bmd
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x100712f2
push ebx
push edi
push 0x708
call fcn.1012baac
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
mov ebx, eax
push 0x708
push ebx
call edi
push esi
push 1
lea eax, [ebp - 0x108]
push 4
push eax
call edi
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x28
mov ecx, 0x708
call fcn.10070ff0
cmp dword [ebp - 0x108], eax
je 0x100712a9
push str.DataLocalMuunData.bmd
lea ecx, [ebp - 0x104]
push str._s___File_corrupted.
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov eax, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0xe8c578]
push 0
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
mov esi, ebx
mov edi, 0x101669c8
push 6
push esi
mov edx, 0x4071a0
call edx
mov eax, dword [esi]
mov dword [edi], eax
mov cx, word [esi + 4]
mov word [edi + 4], cx
add edi, 6
add esp, 8
add esi, 6
cmp edi, 0x101670d0
jl 0x100712b0
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
push str.DataLocalMuunData.bmd
lea edx, [ebp - 0x104]
push str._s___File_not_exist.
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov ecx, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0xe8c578]
push 0
push 0
push 2
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x10071350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0x10135c08
push edi
mov dword [ebp - 0x108], edi
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x10071476
push ebx
push 0x79e0
call fcn.1012baac
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
mov ebx, eax
push 0x79e0
push ebx
call edi
push esi
push 1
lea eax, [ebp - 0x10c]
push 4
push eax
call edi
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x28
mov ecx, 0x79e0
call fcn.10070ff0
cmp dword [ebp - 0x10c], eax
je 0x10071430
mov ecx, dword [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push str._s___File_corrupted.
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov ecx, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0xe8c578]
push 0
push 0
push 2
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
mov esi, ebx
mov edi, 0x101691a0
push 0x68
push esi
mov eax, 0x4071a0
call eax
push 0x68
push esi
push edi
call sub.MSVCR100.dll_memcpy
add edi, 0x68
add esp, 0x14
add esi, 0x68
cmp edi, 0x10170b80
jl 0x10071437
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
push edi
lea ecx, [ebp - 0x104]
push str._s___File_not_exist.
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov eax, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0xe8c578]
push 0
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x10074310
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10135e76
mov eax, 0x409a50
lea ecx, [ebp - 0x20]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x24]
push ecx
push 0x40
push 1
push 0x790a80
call esi
lea edx, [ebp - 0x24]
push edx
mov byte [0x790a80], 1
mov eax, dword [ebp - 0x24]
push eax
push 1
push 0x790a80
call esi
fld dword [ebp + 8]
push ecx
fstp dword [esp]
lea ecx, [ebp - 0x20]
push 0xffffffffffffffff
push ecx
mov edx, 0x790a10
call edx
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push 0x790a80
call esi
lea ecx, [ebp - 0x24]
push ecx
mov byte [0x790a80], 0
mov edx, dword [ebp - 0x24]
push edx
push 1
push 0x790a80
call esi
mov eax, 0x409ad0
lea ecx, [ebp - 0x20]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
Function at 0x10074f90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x178
mov eax, 0x9d00c5
mov edi, ecx
xor bl, bl
call eax
add esp, 4
mov edx, 0x844f60
mov ecx, eax
call edx
mov dword [0x116dcb54], eax
test edi, edi
jne 0x10074fdb
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
test eax, eax
je 0x1007511f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push 0x8450ca
call esi
lea ecx, [ebp - 0x24]
push ecx
mov byte [0x8450ca], 0x6e
mov edx, dword [ebp - 0x24]
push edx
push 1
push 0x8450ca
call esi
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push 0x84515a
call esi
lea ecx, [ebp - 0x24]
push ecx
mov dword [0x84515a], 0x7e56
mov edx, dword [ebp - 0x24]
push edx
push 4
push 0x84515a
call esi
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push 0x845192
call esi
lea ecx, [ebp - 0x24]
push ecx
mov dword [0x845192], 0x7e57
mov edx, dword [ebp - 0x24]
push edx
push 4
push 0x845192
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [0x116dcb54]
push 0
push 0x46
push eax
push edi
mov edx, 0x845090
call edx
mov bl, al
test bl, bl
je 0x1007511e
mov esi, dword [0x116dcb54]
push 0x17
push 0x14
push 0x188
push 0x14a
mov eax, 0x779410
lea ecx, [esi + 0x20]
call eax
push 0x17
push 0x14
push 0x188
push 0x17c
mov edx, 0x779410
lea ecx, [esi + 0xcc]
call edx
push 0x10135e76
mov eax, 0x409a50
lea ecx, [ebp - 0x20]
call eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x20]
push edx
push eax
push ecx
mov edx, 0x790970
lea ecx, [esi + 0x20]
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push ecx
push edx
push eax
mov edx, 0x7853f0
lea ecx, [esi + 0xcc]
call edx
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
Function at 0x1007a6a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd48d6c
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0xd48d6c], 0x1007a110
mov edx, dword [ebp - 4]
push edx
push 4
push 0xd48d6c
call esi
push 0x10079e90
push 0x85c99b
mov bl, 0xe8
call fcn.10110d60
push 0x10079e60
push 0x8676b3
call fcn.10110d60
push 0x1007a550
push 0x8678ea
call fcn.10110d60
add esp, 0x18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007e2b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x1007e0f0
push 0x4fa187
mov bl, 0xe9
call fcn.10110d60
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4fa18c
call esi
mov ecx, 0x4fa18c
lea edx, [ebp - 4]
push edx
mov byte [ecx], 0x90
mov eax, dword [ebp - 4]
push eax
push 1
push ecx
call esi
push 0x1007e0c0
push 0x7e4a6f
call fcn.10110d60
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x7e4a74
call esi
mov edx, 0x7e4a74
lea eax, [ebp - 4]
push eax
mov byte [edx], 0x90
mov ecx, dword [ebp - 4]
push ecx
push 1
push edx
call esi
push 0x1007e040
push 0x4f9cbd
mov bl, 0xe8
call fcn.10110d60
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100800c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x5fc
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x100800ea
mov dword [esi + 4], 0xffffffff
call fcn.1007f120
mov eax, esi
jmp 0x100800ec
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x108c6c3c], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x853822
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x853822], 5
mov edx, dword [ebp - 4]
push edx
push 1
push 0x853822
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8538f9
call esi
mov bl, 6
lea ecx, [ebp - 4]
push ecx
mov byte [0x8538f9], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8538f9
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8533f6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x8533f6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8533f6
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x853461
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x853461], 5
mov edx, dword [ebp - 4]
push edx
push 1
push 0x853461
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x853796
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x853796], 0x108c21d0
mov edx, dword [ebp - 4]
push edx
push 4
push 0x853796
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x85358b
call esi
mov dword [0x85358b], 0xaa
lea ecx, [ebp - 4]
mov edx, dword [ebp - 4]
push ecx
push edx
push 4
push 0x85358b
call esi
mov eax, 0x85351c
mov dword [0x11921ae8], eax
mov dword [0x11921aec], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x85346e
mov dword [0x11921ad8], 0x853472
mov dword [0x11921adc], 0x85349d
mov dword [0x11921ae0], 0x8534c5
mov dword [0x11921ae4], 0x8534f1
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x85346e], 0x11921ad8
mov edx, dword [ebp - 4]
push edx
push 4
push 0x85346e
call esi
cmp dword [0x10234b1c], 0
jne 0x10080287
push 0x100800a0
push 0x853554
mov bl, 0xe8
call fcn.10110d60
push 0x10080080
push 0x85351f
mov bl, 0xe9
call fcn.10110d60
push 0x1007f6b0
push 0x853753
mov bl, 0xe8
call fcn.10110d60
add esp, 0x18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret