joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
push ebp
mov ebp, ecx
mov dword [esp + 8], ebp
push esi
push edi
test ebx, 0x10000
je 0x10039387
xor ebx, 0x10000
mov eax, ebx
sar eax, 8
movzx ecx, al
test al, al
jne 0x10039366
movzx ecx, byte [0x6a38d0]
mov eax, ebx
and eax, 0xffff0000
or eax, ecx
mov ecx, ebp
push eax
mov eax, dword [esp + 0x3c]
push eax
push dword [esp + 0x3c]
inc eax
push dword [esp + 0x3c]
add edx, eax
call fcn.10039330
xor edi, edi
mov dword [esp + 0x3c], edi
test ebx, 0x40000
je 0x100393c8
mov edi, dword [ebp + 4]
mov dword [esp + 0x3c], edi
cmp edi, 0xffffffff
jne 0x100393c8
mov esi, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
test esi, esi
jle 0x100393bc
mov edi, dword [ebp + 0x14]
nop
cmp ecx, dword [edi + edx*8]
cmovl ecx, dword [edi + edx*8]
inc edx
cmp edx, esi
jl 0x100393b0
mov edi, dword [ebp + 0x10]
add edi, ecx
mov dword [esp + 0x3c], edi
mov dword [ebp + 4], edi
mov ecx, dword [esp + 0x30]
mov eax, ebx
shr eax, 0x11
and eax, 0xffffff01
movzx edx, bl
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov dword [esp + 0x28], eax
mov al, byte [ecx]
mov dword [esp + 0x1c], edx
test al, al
je 0x100394c8
mov edx, ebp
inc ecx
mov ebx, esi
mov dword [esp + 0x30], ecx
movzx ecx, al
cmp ecx, dword [edx + 8]
jge 0x100394aa
mov eax, dword [edx + 0x14]
test edi, edi
mov edi, dword [eax + ecx*8]
lea ebp, [eax + ecx*8]
je 0x1003942d
mov eax, dword [esp + 0x3c]
sub eax, dword [edx + 0x10]
sub eax, edi
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add esi, eax
mov eax, dword [esp + 0x3c]
jmp 0x10039432
mov eax, dword [edx + 0x10]
add eax, edi
add eax, ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
sub eax, ebx
cmp eax, dword [esp + 0x34]
jg 0x100394c0
mov ecx, dword [ebp + 4]
xor ebx, ebx
mov eax, dword [esp + 0x38]
add ecx, dword [edx + 0x18]
sub eax, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ebx
cmp dword [edx + 0xc], ebx
jle 0x100394a6
xor edx, edx
mov eax, 0x80
test edi, edi
jle 0x10039493
nop
test eax, eax
jne 0x1003947a
mov eax, 0x80
inc ecx
test byte [ecx], al
je 0x10039484
mov ebx, dword [esp + 0x1c]
mov byte [esi], bl
mov edi, dword [ebp]
inc edx
sar eax, 1
inc esi
cmp edx, edi
jl 0x10039470
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
inc ebx
add esi, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ebx
cmp ebx, dword [edx + 0xc]
jl 0x10039463
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x3c]
mov al, byte [ecx]
test al, al
jne 0x100393f3
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
cmp byte [esp + 0x28], 0
je 0x100394f9
mov edi, dword [ebp + 0xc]
sub esi, ebx
dec edi
imul edi, dword [esp + 0x38]
add edi, ebx
test esi, esi
jle 0x100394f9
mov al, dl
mov ecx, esi
movzx eax, al
imul eax, eax, 0x1010101
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x1003a180
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d555c
call esi
mov eax, 0x1003a0c0
mov byte [0x4d555c], 0xe9
sub eax, 0x4d5561
mov dword [0x4d555d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d555c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d55cc
call esi
mov eax, 0x1003a0d0
mov byte [0x4d55cc], 0xe9
sub eax, 0x4d55d1
mov dword [0x4d55cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d55cc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x441c80
call esi
mov eax, 0x1003a0e0
mov byte [0x441c80], 0xe9
sub eax, 0x441c85
mov dword [0x441c81], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x441c80
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x441cec
call esi
mov eax, 0x1003a0f0
mov byte [0x441cec], 0xe9
sub eax, 0x441cf1
mov dword [0x441ced], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x441cec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d58dc
call esi
mov eax, 0x1003a100
mov byte [0x4d58dc], 0xe9
sub eax, 0x4d58e1
mov dword [0x4d58dd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d58dc
call esi
mov dword [0x51e3b8], 0x1003a110
lea eax, [esp + 4]
mov dword [0x51e3bc], 0x1003a120
push eax
mov dword [0x51e3c0], 0x1003a130
push 0x40
mov dword [0x51e3c4], 0x1003a140
mov dword [0x51e3c8], 0x1003a150
push 4
mov dword [0x51e3cc], 0x1003a160
push 0x4426b5
mov dword [0x51e3d4], 0x1003a170
call esi
lea eax, [esp + 4]
mov dword [0x4426b5], 0x441f0f
push eax
push dword [esp + 8]
push 4
push 0x4426b5
call esi
pop esi
pop ecx
ret

Function at 0x1003af60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x484aa4
call esi
mov eax, 0x1003d570
mov byte [0x484aa4], 0xe9
sub eax, 0x484aa9
mov dword [0x484aa5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x484aa4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x442d44
call esi
mov eax, 0x1003af50
mov byte [0x442d44], 0xe9
sub eax, 0x442d49
mov dword [0x442d45], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x442d44
call esi
pop esi
pop ecx
ret
Function at 0x1003b9a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x6ac7bc], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
je 0x1003bb28
cmp dword [0x6ac790], 0
jne 0x1003bb28
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x1003b9f6
test eax, eax
jne 0x1003b9f6
mov eax, dword [0x51e2ac]
cmp ebx, eax
jne 0x1003b9f6
test eax, eax
jne 0x1003b9f6
mov dword [0x6ac7a0], eax
mov dword [0x6ac7b0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x51e2ac], ebx
xor edi, edi
mov eax, dword [0x6ac7b0]
test al, 5
mov dword [ebp + 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6ac7b0], 0
je 0x1003ba53
test bl, 1
je 0x1003ba4c
mov edi, 4
call eax
mov edx, dword [0x10182520]
mov esi, eax
mov ecx, eax
sub esi, edx
sub ecx, edx
cmp eax, edx
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmovae ecx, esi
cmp ecx, 0xfa
jbe 0x1003ba69
mov edi, 5
jmp 0x1003ba5d
mov edi, 0x10
jmp 0x1003ba69
test bl, 1
je 0x1003ba69
mov edi, 1
call eax
mov dword [0x10182520], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [ebp + 8], 0xa
je 0x1003baa0
test bl, 2
je 0x1003ba9b
or edi, 8
call eax
mov edx, dword [0x10182524]
mov esi, eax
sub esi, edx
mov ecx, eax
sub ecx, edx
cmp eax, edx
cmovae ecx, esi
cmp ecx, 0xfa
jbe 0x1003baaf
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1003baa5
or edi, 0x20
jmp 0x1003baaf
test bl, 2
je 0x1003baaf
or edi, 2
call eax
mov dword [0x10182524], eax
mov esi, dword [ebp - 4]
mov dword [0x6ac7a0], edi
mov dword [0x6ac7b0], edi
mov edi, dword [ebp - 8]
test edi, edi
jne 0x1003bac9
test esi, esi
je 0x1003bb28
mov ecx, dword [0x6ac7a8]
mov dword [ebp - 0x18], ecx
dec ecx
mov edx, dword [0x6ac7a4]
mov dword [ebp - 0x14], edx
dec edx
mov eax, dword [0x6ac7c4]
add eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [0x6ac798]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [0x1013cb0c]
add dword [eax], edi
mov eax, dword [0x1013cb08]
add dword [eax], esi
call dword [0x10121444]
lea eax, [ebp - 0x18]
call dword [0x10121018]
call dword [0x10121424]
mov eax, dword [0x6ac7a8]
mov dword [0x6ac794], eax
mov eax, dword [0x6ac7a4]
mov dword [0x6ac79c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003bb60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c8b78
call esi
mov eax, 0x1003bb40
mov byte [0x4c8b78], 0xe9
sub eax, 0x4c8b7d
mov dword [0x4c8b79], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c8b78
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca698
call esi
mov eax, 0x1003bb50
mov byte [0x4ca698], 0xe9
sub eax, 0x4ca69d
mov dword [0x4ca699], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca698
call esi
pop esi
pop ecx
ret
Function at 0x1003c060
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
push 0x4c
call fcn.100ea148
add esp, 4
test eax, eax
je 0x1003c097
push 0x10007540
push 0x1003c1f0
push 6
lea esi, [eax + 4]
mov dword [eax], 6
push 0xc
push esi
call fcn.100ea246
mov dword [0x1015586c], esi
jmp 0x1003c0a1
mov dword [0x1015586c], 0
sub esp, 0x28
mov ecx, 0x1003bc50
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x1003c0c6
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x1003bc50
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154db8
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1003c10f
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2108
call esi
mov eax, 0x1003c040
mov byte [0x4a2108], 0xe9
sub eax, 0x4a210d
mov dword [0x4a2109], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2108
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2094
call esi
mov eax, 0x1003c050
mov byte [0x4a2094], 0xe9
sub eax, 0x4a2099
mov dword [0x4a2095], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2094
call esi
pop esi
add esp, 0x10
ret

Function at 0x1003cc70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a281c
call esi
mov eax, 0x1003cc30
mov byte [0x4a281c], 0xe9
sub eax, 0x4a2821
mov dword [0x4a281d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a281c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a258c
call esi
mov eax, 0x1003cc40
mov byte [0x4a258c], 0xe9
sub eax, 0x4a2591
mov dword [0x4a258d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a258c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2790
call esi
mov eax, 0x1003cc50
mov byte [0x4a2790], 0xe9
sub eax, 0x4a2795
mov dword [0x4a2791], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2790
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a26d0
call esi
mov eax, 0x1003cc60
mov byte [0x4a26d0], 0xe9
sub eax, 0x4a26d5
mov dword [0x4a26d1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a26d0
call esi
pop esi
pop ecx
ret
Function at 0x1003cfd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c8f4c
call esi
mov eax, 0x1003cfb0
mov byte [0x4c8f4c], 0xe9
sub eax, 0x4c8f51
mov dword [0x4c8f4d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c8f4c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443ef4
call esi
mov eax, 0x1003cf30
sub eax, 0x443ef8
mov dword [0x443ef4], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x443ef4
call esi
pop esi
pop ecx
ret

Function at 0x1003d050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 0x21
push 0x101558d0
push 0x10122374
mov edx, str.ScreenShot
mov ecx, 0x1011f8fc
call fcn.1000dde0
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4c9048
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1003cfc0
mov byte [0x4c9048], 0xe9
sub eax, 0x4c904d
mov dword [0x4c9049], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4c9048
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x1003dcd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447614
call esi
mov eax, 0x1003dfb0
mov byte [0x447614], 0xe9
sub eax, 0x447619
mov dword [0x447615], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447614
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4458bc
call esi
mov eax, 0x1003dcc0
mov byte [0x4458bc], 0xe9
sub eax, 0x4458c1
mov dword [0x4458bd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4458bc
call esi
pop esi
pop ecx
ret

Function at 0x1003ddb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5186fc]
push ebx
push esi
push edi
test eax, eax
je 0x1003ddc6
movzx edi, word [eax + 8]
jmp 0x1003ddc9
or edi, 0xffffffff
mov eax, dword [0x1013cc58]
cmp edi, dword [eax]
jle 0x1003de44
push str._n_Waiting_for_fidget_to_complete...
call fcn.10016d20
mov eax, dword [0x1013cc58]
add esp, 4
cmp edi, dword [eax]
jle 0x1003de44
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
call fcn.1003b920
mov eax, dword [0x1013cc5c]
mov esi, dword [eax]
call ebx
mov edx, eax
mov ecx, eax
sub edx, esi
sub ecx, esi
cmp eax, esi
mov eax, 0x596c34
cmovae ecx, edx
cmp ecx, dword [eax]
jb 0x1003de3b
mov edx, dword [0x1013cc58]
mov eax, 0x5186fc
mov edx, dword [edx]
mov ecx, dword [eax]
call fcn.1005c110
call ebx
mov ecx, dword [0x1013cc5c]
mov dword [ecx], eax
mov eax, dword [0x1013cc58]
inc dword [eax]
jmp 0x1003de40
mov eax, dword [0x1013cc58]
cmp edi, dword [eax]
jg 0x1003ddf0
mov dword [eax], 0
mov eax, dword [0x5186f8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call dword [0x10120e98]
cmp eax, 0xffffffff
jne 0x1003de6d
push str._n_Error_unlocking_fidget_on_transition...
call fcn.10016d20
add esp, 4
pop edi
pop esi
mov dword [0x5186fc], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003de80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5186fc], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0xc], ebx
je 0x1003dfa2
cmp dword [0x518744], 0xffffffff
je 0x1003dfa2
call dword [0x10121424]
push str._nStarting_transition...
call fcn.10016d20
add esp, 4
call fcn.1003ddb0
mov eax, dword [0x518850]
movzx ecx, bl
and eax, 0xfff
or ecx, 0x800
shl ecx, 0x10
or ecx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call dword [0x10120ea0]
mov ebx, eax
test ebx, ebx
jne 0x1003df07
push str._n_Error_locking_transition...
call fcn.10016d20
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov dword [0x1016eaf8], eax
movzx eax, word [ebx + 4]
movsx ecx, ax
test ax, ax
jne 0x1003df20
mov ecx, 0xa
mov eax, 0x2ee
xor edi, edi
cdq
xor esi, esi
idiv ecx
mov dword [ebp - 0xc], eax
movzx eax, word [ebx + 8]
mov dword [ebp - 8], eax
test eax, eax
jle 0x1003df74
nop word [eax + eax]
call fcn.1003b920
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov ecx, eax
sub edx, edi
sub ecx, edi
cmp eax, edi
cmovae ecx, edx
cmp ecx, dword [ebp - 0xc]
jb 0x1003df6f
mov edx, esi
mov ecx, ebx
call fcn.1005c110
inc esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp esi, dword [ebp - 8]
jl 0x1003df40
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call dword [0x10120e98]
cmp eax, 0xffffffff
jne 0x1003df95
push str._n_Error_unlocking_transition...
call fcn.10016d20
add esp, 4
push str._nFinished_transition...
call fcn.10016d20
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e4a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca534
call esi
mov eax, 0x1003e470
mov byte [0x4ca534], 0xe9
sub eax, 0x4ca539
mov dword [0x4ca535], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca534
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca34c
call esi
mov eax, 0x1003e480
mov byte [0x4ca34c], 0xe9
sub eax, 0x4ca351
mov dword [0x4ca34d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca34c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca0ac
call esi
mov eax, 0x1003e490
mov byte [0x4ca0ac], 0xe9
sub eax, 0x4ca0b1
mov dword [0x4ca0ad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca0ac
call esi
pop esi
pop ecx
ret
Function at 0x1003edd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44e92c
call esi
mov eax, 0x1003e280
sub eax, 0x44e930
mov dword [0x44e92c], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44e92c
call esi
call fcn.1003e4a0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d7814
call esi
mov eax, 0x1003edc0
mov byte [0x4d7814], 0xe9
sub eax, 0x4d7819
mov dword [0x4d7815], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d7814
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x482057
call esi
mov eax, 0x1003ed30
sub eax, 0x48205b
mov dword [0x482057], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x482057
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x48208a
call esi
mov eax, 0x1003ed40
sub eax, 0x48208e
mov dword [0x48208a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x48208a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47ed24
call esi
mov eax, 0x1003ed80
sub eax, 0x47ed28
mov dword [0x47ed24], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47ed24
call esi
pop esi
pop ecx
ret

Function at 0x1003f5d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d36d4
call esi
mov eax, fcn.1003eee0
mov byte [0x4d36d4], 0xe9
sub eax, 0x4d36d9
mov dword [0x4d36d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d36d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d3704
call esi
mov eax, fcn.1003efb0
mov byte [0x4d3704], 0xe9
sub eax, 0x4d3709
mov dword [0x4d3705], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d3704
call esi
pop esi
pop ecx
ret

Function at 0x10040680
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.1003f5d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48f1b0
call esi
mov eax, 0x10040650
mov byte [0x48f1b0], 0xe9
sub eax, 0x48f1b5
mov dword [0x48f1b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48f1b0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4897ec
call esi
mov eax, 0x10040660
mov byte [0x4897ec], 0xe9
sub eax, 0x4897f1
mov dword [0x4897ed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4897ec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x489550
call esi
mov eax, 0x10040670
mov byte [0x489550], 0xe9
sub eax, 0x489555
mov dword [0x489551], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x489550
call esi
pop esi
pop ecx
ret
Function at 0x10040740
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edx, 0x6639d0
mov edi, eax
push 0x3c
mov ecx, edx
call fcn.10017280
call esi
mov ecx, eax
movss xmm1, dword [0x1013cd98]
mov esi, eax
sub ecx, edi
sub esi, edi
cmp eax, edi
mov eax, 0x20
cmovae esi, ecx
test esi, esi
cmove esi, eax
xor edx, edx
mov eax, 0xa410
div esi
ucomiss xmm1, dword [0x101327c8]
mov ecx, eax
lahf
test ah, 0x44
jnp 0x100407a3
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
cvttss2si ecx, xmm0
push ecx
push esi
push str._nFade_time_is__u__steps_are__d_n
mov dword [0x6642d0], ecx
call fcn.10016d20
add esp, 0xc
pop edi
pop esi
pop ecx
ret

Function at 0x10040a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e97c
call esi
mov eax, 0x10040fa0
mov byte [0x42e97c], 0xe9
sub eax, 0x42e981
mov dword [0x42e97d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e97c
call esi
push 0x64
mov edx, str.FadeMultiplier
mov ecx, str.Graphics
call fcn.1000dcb0
cmp eax, 0x64
je 0x10040aa7
test eax, eax
mov ecx, 1
cmovle eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x10132790]
movss dword [0x1013cd98], xmm0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x493a00
call esi
mov eax, 0x100407c0
mov byte [0x493a00], 0xe9
sub eax, 0x493a05
mov dword [0x493a01], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x493a00
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x493ad4
call esi
mov eax, 0x100409b0
mov byte [0x493ad4], 0xe9
sub eax, 0x493ad9
mov dword [0x493ad5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x493ad4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x493b48
call esi
mov eax, 0x100409c0
mov byte [0x493b48], 0xe9
sub eax, 0x493b4d
mov dword [0x493b49], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x493b48
call esi
pop esi
pop ecx
ret