joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009a480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp dword [0x10160114], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, ecx
je 0x1009a4d1
lea eax, [esp + 8]
mov dword [0x10160114], 0
push eax
push 0x40
push 1
push 0x49952c
call esi
lea eax, [esp + 8]
mov byte [0x49952c], 0x85
push eax
push dword [esp + 0xc]
push 1
push 0x49952c
call esi
xor cl, cl
mov byte [0x10175030], cl
jmp 0x1009a4d7
mov cl, byte [0x10175030]
mov eax, ebx
and eax, 7
mov dword [0x10160114], eax
je 0x1009a528
test bl, 1
je 0x1009a515
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x49952c
call esi
lea eax, [esp + 8]
mov byte [0x49952c], 0x31
push eax
push dword [esp + 0xc]
push 1
push 0x49952c
call esi
pop esi
pop ebx
pop ecx
ret
movzx eax, cl
test bl, 4
mov ecx, 1
cmovne eax, ecx
mov byte [0x10175030], al
pop esi
pop ebx
pop ecx
ret

Function at 0x1009add0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x1015484c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x10154858]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x10154844]
cmp edi, edx
jne 0x1009ae30
mov ecx, edx
jmp 0x1009ae35
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1009ae5a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1009ae44
mov eax, dword [eax]
jmp 0x1009ae28
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8

Function at 0x1009b020
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x1015481c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x10154828]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x10154814]
cmp edi, edx
jne 0x1009b080
mov ecx, edx
jmp 0x1009b085
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1009b0aa
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1009b094
mov eax, dword [eax]
jmp 0x1009b078
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8
Function at 0x1009b4b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010f580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x1009b531
mov esi, dword [ebx + 4]
jmp 0x1009b537
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1009b54c
mov ecx, dword [edi]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x1009b596
cmp esi, eax
jne 0x1009b540
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1009b57c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1009b606
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1009b628
mov edx, dword [ebp + 0x10]
lea edi, [edx + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x1009b5c8
mov ecx, dword [edi]
lea edx, [eax + 1]
push 1
call fcn.1000d8e0
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x1009b5de
mov edi, dword [edi]
push edx
mov byte [edi], 0
call fcn.100e9b9e
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x1009b60e
mov dword [ecx], edi
jmp 0x1009b628
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1009b628
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1009b720
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1009d090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x10]
push esi
push 1
push 4
push eax
mov dword [esp + 0x24], esi
call fcn.100f6e6a
add esp, 0x10
cmp eax, 1
je 0x1009d0c2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [esp + 0x10], ebx
jbe 0x1009d145
nop word [eax + eax]
push esi
push 1
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.100f6e6a
mov eax, dword [0x10154924]
add esp, 0x10
mov esi, dword [eax]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esi + 4]
push esi
call fcn.100a02c0
mov edx, dword [0x10154928]
mov ecx, 0xaaaaaa9
sub ecx, edx
mov edi, eax
cmp ecx, 1
jb 0x1009d14e
inc edx
mov ecx, 0x10154920
mov dword [0x10154928], edx
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [0x10154924]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1009f880
mov esi, dword [esp + 0x14]
inc ebx
cmp ebx, dword [esp + 0x10]
jb 0x1009d0d0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.100e89e5
int3

Function at 0x1009d160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x10154928]
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
push edi
push 1
lea eax, [esp + 0x14]
push 4
push eax
call fcn.100f5ff9
mov eax, dword [0x10154924]
add esp, 0x10
mov dword [esp + 0x1c], 0
mov esi, dword [eax]
cmp esi, eax
je 0x1009d1d1
nop dword [eax + eax]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xc]
push edi
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x10]
push 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.100f5ff9
mov esi, dword [esi]
add esp, 0x10
cmp esi, dword [0x10154924]
jne 0x1009d1a0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009e360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [esp + 0xc], edi
jb 0x1009e37b
mov esi, dword [ebx]
jmp 0x1009e37d
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1009e399
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1009e388
mov ecx, dword [0x10154918]
and ecx, edx
mov edx, dword [0x1015490c]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [esp + 0x10], esi
lea ecx, [edx + ecx*4]
mov dword [esp + 0x14], ecx
nop dword [eax + eax]
mov edx, dword [0x10154904]
cmp esi, edx
jne 0x1009e3ce
mov ecx, edx
jmp 0x1009e3d2
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1009e517
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x1009e3e7
mov edi, dword [ebx]
jmp 0x1009e3e9
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x1009e3f4
mov edx, dword [edx]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov esi, ecx
cmp dword [esp + 0x20], ecx
cmovb esi, dword [esp + 0x20]
test esi, esi
je 0x1009e466
sub esi, 4
jb 0x1009e423
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x1009e428
add edx, 4
add edi, 4
sub esi, 4
jae 0x1009e412
cmp esi, 0xfffffffc
je 0x1009e45c
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x1009e455
cmp esi, 0xfffffffd
je 0x1009e45c
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x1009e455
cmp esi, 0xfffffffe
je 0x1009e45c
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x1009e455
cmp esi, 0xffffffff
je 0x1009e45c
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x1009e45c
sbb ecx, ecx
or ecx, 1
jmp 0x1009e45e
xor ecx, ecx
test ecx, ecx
jne 0x1009e470
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jb 0x1009e470
jbe 0x1009e47f
mov eax, dword [eax]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x1009e3c0
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x1009e48d
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x1009e495
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ecx, edi
mov esi, edi
cmovb esi, ecx
test esi, esi
je 0x1009e4fb
sub esi, 4
jb 0x1009e4b8
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x1009e4bd
add ebx, 4
add edx, 4
sub esi, 4
jae 0x1009e4a7
cmp esi, 0xfffffffc
je 0x1009e4f1
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x1009e4ea
cmp esi, 0xfffffffd
je 0x1009e4f1
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x1009e4ea
cmp esi, 0xfffffffe
je 0x1009e4f1
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x1009e4ea
cmp esi, 0xffffffff
je 0x1009e4f1
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x1009e4f1
sbb ecx, ecx
or ecx, 1
jmp 0x1009e4f3
xor ecx, ecx
test ecx, ecx
jne 0x1009e501
mov ecx, dword [esp + 0xc]
cmp ecx, edi
jb 0x1009e501
jbe 0x1009e506
mov eax, dword [0x10154904]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [eax], edx
add esp, 0xc
ret 8
Function at 0x1009e5d0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x101548ec]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x101548f8]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x101548e4]
cmp edi, edx
jne 0x1009e630
mov ecx, edx
jmp 0x1009e635
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1009e65a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1009e644
mov eax, dword [eax]
jmp 0x1009e628
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8

Function at 0x1009e710
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x101548cc]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x101548d8]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x101548c4]
cmp edi, edx
jne 0x1009e770
mov ecx, edx
jmp 0x1009e775
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1009e79a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1009e784
mov eax, dword [eax]
jmp 0x1009e768
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8

Function at 0x1009f450
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret 4
Function at 0x100a0680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push ebp
push esi
lea esi, [eax + 8]
mov ebp, ecx
push edi
jb 0x100a0698
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x100a06b4
movzx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x100a06a3
mov ecx, dword [ebp + 0x18]
and ecx, edi
lea edx, [ecx*8]
mov ecx, dword [ebp + 0xc]
add ecx, edx
cmp dword [ecx + 4], eax
jne 0x100a06e7
cmp dword [ecx], eax
jne 0x100a06df
mov eax, dword [ebp + 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
mov dword [ecx + edx + 4], eax
jmp 0x100a06ef
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x100a06ef
cmp dword [ecx], eax
jne 0x100a06f3
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push eax
push esi
call fcn.100a0710
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x100a1660
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x10154944]
push edi
mov edi, ecx
mov dword [esp + 4], eax
push edi
push 1
lea eax, [esp + 0xc]
push 4
push eax
call fcn.100f5ff9
add esp, 0x10
cmp dword [esp + 4], 0
je 0x100a16ec
mov eax, dword [0x10154940]
push esi
mov esi, dword [eax]
cmp esi, eax
je 0x100a16b8
mov eax, dword [esi + 8]
push edi
push 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 4
push eax
call fcn.100f5ff9
mov esi, dword [esi]
add esp, 0x10
mov eax, dword [0x10154940]
cmp esi, eax
jne 0x100a1694
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x10154940]
mov dword [eax + 4], eax
mov dword [0x10154944], 0
cmp ecx, dword [0x10154940]
je 0x100a16eb
mov esi, dword [ecx]
push ecx
call fcn.100e9b9e
add esp, 4
mov ecx, esi
cmp esi, dword [0x10154940]
jne 0x100a16d6
pop esi
pop edi
add esp, 8
ret

Function at 0x100a1700
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebp
mov ebp, ecx
push ebp
push 1
push 4
push eax
call fcn.100f6e6a
add esp, 0x10
cmp eax, 1
je 0x100a1723
xor al, al
pop ebp
add esp, 0xc
ret
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
jbe 0x100a178d
nop
push ebp
push 1
lea eax, [esp + 0x1c]
push 4
push eax
call fcn.100f6e6a
add esp, 0x10
cmp eax, 1
jne 0x100a1797
mov eax, dword [esp + 0x14]
mov ebx, dword [0x10154940]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [ebx + 4]
push ebx
call fcn.100a4c30
mov edx, dword [0x10154944]
mov ecx, 0x15555554
sub ecx, edx
mov esi, eax
cmp ecx, 1
jb 0x100a17a1
inc edx
inc edi
mov dword [0x10154944], edx
mov dword [ebx + 4], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
cmp edi, dword [esp + 0x10]
jb 0x100a1730
pop edi
pop esi
pop ebx
xor al, al
pop ebp
add esp, 0xc
ret
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
add esp, 0xc
ret
push str.list_T__too_long
call fcn.100e89e5
int3
Function at 0x100a9770
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x1017533c]
push esi
push 0
mov esi, ecx
lea ecx, [esp + 0xc]
mov edx, dword [eax]
push ecx
push 2
push 0x16
push dword [0x1016e910]
push dword [0x1016e90c]
push eax
call dword [edx + 0x90]
mov eax, dword [0x1017533c]
push dword [esp + 8]
push dword [0x1016ea60]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x80]
lea eax, [esp + 4]
push eax
mov eax, dword [0x1016e90c]
imul eax, dword [0x1016e910]
add eax, eax
push eax
call dword [sym.imp.d3dx9_43.dll_D3DXCreateBuffer]
push 0
push 0
push dword [esp + 0x10]
lea eax, [esp + 0x10]
push 3
push eax
call dword [sym.imp.d3dx9_43.dll_D3DXSaveSurfaceToFileInMemory]
mov eax, dword [esp + 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push eax
call fcn.100f5ff9
push esi
call fcn.100f22da
mov eax, dword [esp + 0x1c]
add esp, 0x14
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x100aa110
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0xa
mov esi, ecx
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100aa12c
pop edi
xor al, al
pop esi
pop ecx
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push 0x1012cbb8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100aa170
pop ebx
pop edi
xor al, al
pop esi
pop ecx
ret
push 0
lea eax, [esp + 0x10]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov al, 1
pop esi
pop ecx
ret

Function at 0x100aa190
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
test edi, edi
jle 0x100aa1f5
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + edx]
push eax
push ecx
call ebp
test eax, eax
jle 0x100aa1cb
add esi, eax
jmp 0x100aa1db
call ebx
cmp eax, 0x2733
je 0x100aa1db
cmp eax, 0x2747
jne 0x100aa1e9
cmp esi, edi
jge 0x100aa1f5
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x100aa1b5
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 4
Function at 0x100aa210
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
test edi, edi
jle 0x100aa275
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + edx]
push eax
push ecx
call ebp
test eax, eax
jle 0x100aa24b
add esi, eax
jmp 0x100aa25b
call ebx
cmp eax, 0x2733
je 0x100aa25b
cmp eax, 0x2747
jne 0x100aa269
cmp esi, edi
jge 0x100aa275
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x100aa235
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 4
Function at 0x100aad50
Capabilities:
Create process on windows
Create tcp socket
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x204
lea eax, [esp + 0x74]
push ebx
push esi
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100aaeb2
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x100aaeac
mov eax, 2
push 0x1012cbcc
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x1095
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x100aae3e
push 4
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x100aae3e
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.100ed150
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
xorps xmm0, xmm0
add esp, 0xc
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x38], 0x44
mov bl, 1
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.FalloutDebug.exe__debugedit
push 0x1012cbb8
call esi
test eax, eax
jne 0x100aae52
mov al, bl
dec bl
test al, al
je 0x100aae3e
mov ecx, dword [0x10142bb8]
call fcn.100aa110
test al, al
jne 0x100aae01
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x20]
call esi
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x100aae3e
mov eax, dword [0x10142bb4]
test eax, eax
je 0x100aae94
mov ecx, dword [eax]
cmp ecx, 0x1011fc38
jne 0x100aae90
mov eax, dword [eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
lea ecx, [esp + 0xc]
call fcn.100aa290
push dword [esp + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push edi
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ab3a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.DontDeleteProtos
mov edx, str.Debugging
mov ecx, str..ddraw.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x100ab41d
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100ab4c6
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100ab44b
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
test esi, esi
je 0x100ab4c6
cmp byte [0x10174f84], 0
je 0x100ab49a
test byte [0x10174f88], 1
je 0x100ab49a
mov edx, str.Applying_permanent_protos_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100ab49a
mov edx, str.Applying_permanent_protos_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x48007e
call esi
lea eax, [ebp - 0x10]
mov byte [0x48007e], 0xeb
push eax
push dword [ebp - 0x10]
push 1
push 0x48007e
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret