joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10005436
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10005425
jg 0x10005390
test edx, edx
je 0x10005425
nop dword [eax]
call fcn.100076c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100053e4
jg 0x100053a7
test esi, esi
je 0x100053e4
cmp ebx, eax
jg 0x100053b7
jl 0x100053b1
cmp edi, esi
jae 0x100053b7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.1003c160
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10005409
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x1000541f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10005390
jl 0x1000541f
test edi, edi
jne 0x10005390
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x1000545e
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x10005464
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
test edi, edi
jl 0x100054cc
jg 0x10005479
test esi, esi
je 0x100054cc
test edx, edx
jl 0x100054c7
jg 0x10005483
test eax, eax
je 0x100054c7
cmp edi, edx
jg 0x10005497
jl 0x1000548d
cmp esi, eax
jae 0x10005497
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.1003c160
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0xc]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x100054cf
mov ebx, dword [ebp + 8]
jmp 0x100054d9
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x100054f2
jg 0x100054d9
test esi, esi
je 0x100054f2
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x100054f2
push eax
push esi
push 1
push ebx
call fcn.10040675
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10005a80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10005abc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10005abc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10005bb7
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10005ae4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005b17
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1003fe82
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10005b77
sub eax, 1
je 0x10005b77
sub eax, 2
jne 0x10005bb7
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.1003fe82
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10005b94
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10040675
add esp, 0x10
cmp edi, eax
jne 0x10005bb7
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002063c
mov esp, ebp
pop ebp
ret 4
Function at 0x10005d40
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d6ef
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0
lea ecx, [ebx + 0x70]
mov dword [ebx], 0x1006b7ac
call fcn.100078b0
sub esp, 8
mov dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov dword [ebp - 0x18], 1
mov ecx, ebx
mov dword [ebp - 0x14], esi
push esi
call fcn.10007760
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x70]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.10007bf0
lea eax, [ebx + 0x10]
lea ebx, [eax + 4]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea esi, [eax + 8]
mov byte [eax + 0x48], 0
lea edi, [eax + 0x14]
mov byte [eax + 0x3d], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x1c]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x1010b234]
mov dword [eax], 0
mov eax, dword [0x1010b230]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x14]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 2
cmp dword [ebx + 0x4c], 0
jne 0x10005ed2
mov eax, dword [ebp + 0xc]
push 0x40
or eax, 1
push eax
push str.voobly.log
call fcn.10021bb9
add esp, 0xc
test eax, eax
je 0x10005ed2
push 1
push eax
mov ecx, ebx
call fcn.100075d0
mov eax, dword [ebx + 0x34]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.10007f90
add esp, 4
mov ecx, ebx
push eax
call fcn.10007470
test esi, esi
je 0x10005ebb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x10005ebb
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10003fa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100075ba
cmp byte [esi + 0x3d], 0
je 0x100075ba
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100075a8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10007570
sub eax, 1
je 0x10007574
sub eax, 2
jne 0x100075a8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10007591
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10040675
add esp, 0x10
cmp edi, eax
jne 0x100075a8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002063c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1002063c
mov esp, ebp
pop ebp
ret
Function at 0x10007760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d86d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.10003fa0
push 8
call fcn.1002064a
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.10021806
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.10007e70
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x1000787d
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x10007899
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.10003fa0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10007bf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d8b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1002064a
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10021806
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10007b60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10008870
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push 0x40
push 5
push 0x568332
call ebx
mov byte [0x568332], 0xe9
mov eax, 0x100086a0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffa97cc9
mov dword [0x568333], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x568332
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x568337
call ebx
mov esi, 0x568337
lea eax, [ebp - 0x10]
push eax
mov edi, 0x90909090
mov word [esi], di
push dword [ebp - 0x14]
push 2
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x5683aa
call ebx
mov byte [0x5683aa], 0xe9
mov eax, 0x10008740
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffa97c51
mov dword [0x5683ab], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x5683aa
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push esi
call ebx
lea eax, [ebp - 0x10]
mov word [esi], di
push eax
push dword [ebp - 0x14]
push 2
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xe9
push eax
push 0x555584
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x10008660
sub eax, 0x555589
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x555585
call edi
push eax
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x40b89f
call edi
push eax
call esi
mov eax, 0x10008680
sub eax, 0x40b8a4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x40b8a0
call edi
push eax
call esi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 7
push 0x525c12
call ebx
mov eax, 0x525c12
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 7
push 0x525c12
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x525c12
call ebx
mov byte [0x525c12], 0xe9
mov eax, 0x100085a0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffada3e9
mov dword [0x525c13], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x525c12
call ebx
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 2
push eax
push 0x527c4e
call edi
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008af0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x45571f
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x10008a40
sub eax, 0x455724
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x455720
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x455724
call esi
mov eax, 0x455724
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x455724
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x40d813
call ebx
push eax
call edi
mov eax, 0x10008a60
sub eax, 0x40d818
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x40d814
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x40d818
call esi
mov eax, 0x40d818
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x40d818
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x6063fd
call ebx
push eax
call edi
mov eax, 0x10008aa0
sub eax, 0x606402
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x6063fe
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 3
push 0x606402
call esi
mov eax, 0x606402
mov ecx, 0x90909090
mov word [eax], cx
mov byte [eax + 2], cl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 3
push 0x606402
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c9f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x56906d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x1000c930
sub eax, 0x569072
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x56906e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push 0x569072
call esi
mov eax, 0x569072
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 2
push 0x569072
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000d6e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x527c13
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x1000cc50
sub eax, 0x527c18
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x527c14
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x51e605
call ebx
push eax
call edi
mov eax, 0x1000d060
sub eax, 0x51e60a
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x51e606
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x51e60a
call esi
mov eax, 0x51e60a
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 2
push 0x51e60a
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x603d4b
call ebx
push eax
call edi
mov eax, 0x1000d1c0
sub eax, 0x603d50
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x603d4c
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x450a4e
call esi
mov byte [0x450a4e], 0xe9
mov eax, 0x1000cc30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffbaf5ad
mov dword [0x450a4f], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x450a4e
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x527b3f
call ebx
push eax
call edi
mov eax, 0x1000d2c0
sub eax, 0x527b44
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x527b40
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x602dd0
call ebx
push eax
call edi
mov eax, 0x1000d670
sub eax, 0x602dd5
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x602dd1
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x555593
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x1000f270
sub eax, 0x555598
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x555594
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x40b8ae
call ebx
push eax
call edi
mov eax, 0x1000f250
sub eax, 0x40b8b3
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x40b8af
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x40b8b3
call esi
mov eax, 0x40b8b3
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x40b8b3
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4cb02e
call ebx
push eax
call edi
mov eax, 0x1000eec0
sub eax, 0x4cb033
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4cb02f
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4cb0ae
call ebx
push eax
call edi
mov eax, 0x1000efc0
sub eax, 0x4cb0b3
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4cb0af
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x5a06aa
call ebx
push eax
call edi
mov eax, 0x1000f0e0
sub eax, 0x5a06af
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x5a06ab
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x5a06af
call esi
mov eax, 0x5a06af
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x5a06af
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x5ce960
call ebx
push eax
call edi
mov eax, 0x1000f0b0
sub eax, 0x5ce965
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x5ce961
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x6013a1
call esi
mov byte [0x6013a1], 0xe9
mov eax, 0x10011dc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xff9fec5a
mov dword [0x6013a2], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x6013a1
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x602d64
call esi
mov byte [0x602d64], 0xe9
mov eax, 0x10011f80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xff9fd297
mov dword [0x602d65], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x602d64
call esi
pop esi
mov esp, ebp
pop ebp
ret