joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100421b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10064018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xd4e5e8
push str.DataLocalAmuletTooltip.bmd
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x100422e7
push ebx
push edi
push 0xf000
call fcn.10056d67
push 0xf000
mov dword [0x100c7d4c], eax
call fcn.10056d67
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
mov ebx, eax
push 0xf000
push ebx
call edi
push esi
push 1
lea eax, [ebp - 0x108]
push 4
push eax
call edi
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x2c
mov ecx, 0xf000
call fcn.10056cd0
cmp dword [ebp - 0x108], eax
je 0x10042298
push str.DataLocalAmuletTooltip.bmd
lea ecx, [ebp - 0x104]
push 0xd2bb20
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov eax, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0xe8c578]
push 0
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
mov esi, ebx
xor edi, edi
lea esp, [esp]
push 0x1e
push esi
mov edx, 0x4071a0
call edx
mov eax, dword [0x100c7d4c]
push 0x1e
lea ecx, [edi + eax]
push esi
push ecx
call sub.MSVCR100.dll_memcpy
add edi, 0x1e
add esp, 0x14
add esi, 0x1e
cmp edi, 0xf000
jl 0x100422a0
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
push str.DataLocalAmuletTooltip.bmd
lea edx, [ebp - 0x104]
push 0xd2bb38
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov ecx, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0xe8c578]
push 0
push 0
push 2
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10058d40
mov esp, ebp
pop ebp
ret
Function at 0x10042340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10064018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0xd4e5e8
push edi
mov dword [ebp - 0x108], edi
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x10042487
push ebx
push 0x7f800
call fcn.10056d67
push 0x7f800
mov dword [0x100c7d48], eax
call fcn.10056d67
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
mov ebx, eax
push 0x7f800
push ebx
call edi
push esi
push 1
lea eax, [ebp - 0x10c]
push 4
push eax
call edi
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x2c
mov ecx, 0x7f800
call fcn.10056cd0
cmp dword [ebp - 0x10c], eax
je 0x1004242f
mov ecx, dword [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push 0xd2bb20
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov ecx, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0xe8c578]
push 0
push 0
push 2
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
mov esi, ebx
xor edi, edi
push 0xff
push esi
mov eax, 0x4071a0
call eax
mov ecx, dword [0x100c7d48]
push 0xff
lea edx, [edi + ecx]
push esi
push edx
call sub.MSVCR100.dll_memcpy
add edi, 0xff
add esp, 0x14
add esi, 0xff
cmp edi, 0x7f800
jl 0x10042433
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x104]
push 0xd2bb38
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edx, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0xe8c578]
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10058d40
mov esp, ebp
pop ebp
ret

Function at 0x10044e30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x10044c00
push 0x832940
mov bl, 0xe9
call fcn.10056900
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd46c78
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0xd46c78], 0x10044d50
mov edx, dword [ebp - 4]
push edx
push 4
push 0xd46c78
call esi
push 0x10044aa0
push 0x51ad6e
mov bl, 0xe8
call fcn.10056900
push 0x10044cd0
push 0x832050
mov bl, 0xe9
call fcn.10056900
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100457f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x8367ba
call esi
mov edi, 0x14
lea ecx, [ebp - 4]
push ecx
mov dword [0x8367ba], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x8367ba
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x8367c7
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x8367c7], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x8367c7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x836805
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x836805], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x836805
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x836812
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x836812], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x836812
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x836853
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x836853], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x836853
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x836860
call esi
mov dword [0x836860], edi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x836860
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8367e0
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x8367e0], 0x3a
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8367e0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x83682b
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x83682b], 0x3a
mov edx, dword [ebp - 4]
push edx
push 1
push 0x83682b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x836792
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x836792], 0x76
mov edx, dword [ebp - 4]
push edx
push 1
push 0x836792
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10049f20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x5fc
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x10049f4a
mov dword [esi + 4], 0xffffffff
call fcn.100498d0
mov eax, esi
jmp 0x10049f4c
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x100c7dbc], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x853822
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x853822], 5
mov edx, dword [ebp - 4]
push edx
push 1
push 0x853822
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8538f9
call esi
mov bl, 6
lea ecx, [ebp - 4]
push ecx
mov byte [0x8538f9], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8538f9
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8533f6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x8533f6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8533f6
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x853461
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x853461], 5
mov edx, dword [ebp - 4]
push edx
push 1
push 0x853461
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x853796
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x853796], 0x100bb8a0
mov edx, dword [ebp - 4]
push edx
push 4
push 0x853796
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x85358b
call esi
mov dword [0x85358b], 0xaa
lea ecx, [ebp - 4]
mov edx, dword [ebp - 4]
push ecx
push edx
push 4
push 0x85358b
call esi
mov eax, 0x85351c
mov dword [0x101de240], eax
mov dword [0x101de244], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x85346e
mov dword [0x101de230], 0x853472
mov dword [0x101de234], 0x85349d
mov dword [0x101de238], 0x8534c5
mov dword [0x101de23c], 0x8534f1
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x85346e], 0x101de230
mov edx, dword [ebp - 4]
push edx
push 4
push 0x85346e
call esi
push 0x10049ef0
push 0x7d349a
mov bl, 0xe8
call fcn.10056900
push 0x10049de0
push 0x853554
call fcn.10056900
push 0x10049dc0
push 0x85351f
mov bl, 0xe9
call fcn.10056900
push 0x10049e00
push 0x4d55ca
mov bl, 0xe8
call fcn.10056900
push 0x10049e40
push 0x8606b0
mov bl, 0xe9
call fcn.10056900
push 0x10049a50
push 0x853753
mov bl, 0xe8
call fcn.10056900
add esp, 0x30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004a4e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8606d6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x8606d6], 0x6f
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8606d6
call esi
push 0x1004a150
push 0x7d35a8
mov bl, 0xe8
call fcn.10056900
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d0e17
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d0e17], 0x1004a4d0
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d0e17
call esi
push 0x1004a1e0
push 0x4d2a04
call fcn.10056900
push 0x1004a470
push 0x7d378e
call fcn.10056900
push 0x1004a470
push 0x811c42
call fcn.10056900
push 0x1004a350
push 0x4d9344
call fcn.10056900
push 0x1004a3d0
push 0x4d9cc2
call fcn.10056900
push 0x1004a230
push 0x4d58a0
call fcn.10056900
push 0x1004a2f0
push 0x4d935c
call fcn.10056900
push 0x1004a2f0
push 0x5b67b9
call fcn.10056900
add esp, 0x40
push 0x1004a2f0
push 0x5b832f
call fcn.10056900
push 0x1004a2f0
push 0x5cf380
call fcn.10056900
push 0x1004a2a0
push 0x4d6cf7
call fcn.10056900
push 0x1004a2a0
push 0x4e14f3
call fcn.10056900
push 0x1004a2a0
push 0x63e4c9
call fcn.10056900
push 0x1004a2a0
push 0x63ef07
call fcn.10056900
push 0x1004a2a0
push 0x641021
call fcn.10056900
push 0x1004a2a0
push 0x64be83
call fcn.10056900
add esp, 0x40
push 0x1004a2a0
push 0x64bf85
call fcn.10056900
push 0x1004a2a0
push 0x64c566
call fcn.10056900
push 0x1004a2a0
push 0x64c6cd
call fcn.10056900
push 0x1004a2a0
push 0x654255
call fcn.10056900
push 0x1004a2a0
push 0x654d25
call fcn.10056900
push 0x1004a2a0
push 0x659051
call fcn.10056900
push 0x1004a2a0
push 0x6595bd
call fcn.10056900
push 0x1004a2a0
push 0x659618
call fcn.10056900
add esp, 0x40
push 0x1004a2a0
push 0x659ed8
call fcn.10056900
push 0x1004a2a0
push 0x65f55c
call fcn.10056900
push 0x1004a2a0
push 0x65f63a
call fcn.10056900
push 0x1004a2a0
push 0x65f706
call fcn.10056900
push 0x1004a2a0
push 0x666d16
call fcn.10056900
push 0x1004a2a0
push 0x85f7ef
call fcn.10056900
push 0x1004a2a0
push 0x872549
call fcn.10056900
push 0x1004a2a0
push 0x91cc15
call fcn.10056900
add esp, 0x40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004b9f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1004bc20
mov dword [esp + 0x24], 0x48
mov dword [esp + 0x28], 0x49
mov dword [esp + 0x2c], 0x4a
mov dword [esp + 0x30], 0x4b
mov dword [esp + 0x34], 0x4c
mov dword [esp + 0x38], 0x4d
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
movzx eax, word [esp + eax*4 + 0x24]
cwde
lea esi, [eax + eax*8]
add esi, esi
add esi, esi
add esi, esi
fld dword [esi + 0x100bd694]
call fcn.100596f0
fld dword [esi + 0x100bd698]
mov edi, eax
call fcn.100596f0
fld dword [esi + 0x100bd68c]
mov ebx, eax
call fcn.100596f0
fld dword [esi + 0x100bd690]
mov dword [esp + 0x20], eax
call fcn.100596f0
mov ecx, dword [esp + 0x20]
push eax
push ecx
push ebx
push edi
mov edx, 0x790b10
call edx
mov edi, dword [esp + 0x28]
add esp, 0x10
test al, al
je 0x1004bb2d
mov esi, dword [esp + edi*4 + 0x24]
lea esi, [esi + esi*8]
add esi, esi
add esi, esi
add esi, esi
cmp byte [esi + 0x100bd6a9], 0
je 0x1004bb2d
mov eax, dword [esp + 0x1c]
sub eax, dword [esi + 0x100bd6a4]
cmp dword [ebp + 8], 0x201
je 0x1004bbb6
mov byte [esi + 0x100bd6a8], 0
cmp eax, 0x1f4
jb 0x1004bc20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x100bd6a4], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], edi
call fcn.10052330
add esp, 4
inc edi
mov dword [esp + 0x18], edi
cmp edi, 6
jl 0x1004ba63
fld dword [0x100bfa04]
call fcn.100596f0
fld dword [0x100bfa08]
mov esi, eax
call fcn.100596f0
fld dword [0x100bf9fc]
mov edi, eax
call fcn.100596f0
fld dword [0x100bfa00]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1004bc20
cmp byte [0x100bfa19], 0
je 0x1004bc20
cmp dword [ebp + 8], 0x201
jne 0x1004bbdb
mov byte [0x100bfa18], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + edi*4 + 0x24]
lea ecx, [edi + edi*8]
mov byte [ecx*8 + 0x100bd6a8], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x1c]
sub eax, dword [0x100bfa14]
mov byte [0x100bfa18], 0
cmp eax, 0x1f4
jb 0x1004bc20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bfa14], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], 7
call fcn.10052330
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.10058d40
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bc40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10064018]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1004be70
mov dword [esp + 0x24], 0x48
mov dword [esp + 0x28], 0x49
mov dword [esp + 0x2c], 0x4a
mov dword [esp + 0x30], 0x4b
mov dword [esp + 0x34], 0x4c
mov dword [esp + 0x38], 0x4d
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
movzx eax, word [esp + eax*4 + 0x24]
cwde
lea esi, [eax + eax*8]
add esi, esi
add esi, esi
add esi, esi
fld dword [esi + 0x100bd694]
call fcn.100596f0
fld dword [esi + 0x100bd698]
mov edi, eax
call fcn.100596f0
fld dword [esi + 0x100bd68c]
mov ebx, eax
call fcn.100596f0
fld dword [esi + 0x100bd690]
mov dword [esp + 0x20], eax
call fcn.100596f0
mov ecx, dword [esp + 0x20]
push eax
push ecx
push ebx
push edi
mov edx, 0x790b10
call edx
mov edi, dword [esp + 0x28]
add esp, 0x10
test al, al
je 0x1004bd7d
mov esi, dword [esp + edi*4 + 0x24]
lea esi, [esi + esi*8]
add esi, esi
add esi, esi
add esi, esi
cmp byte [esi + 0x100bd6a9], 0
je 0x1004bd7d
mov eax, dword [esp + 0x1c]
sub eax, dword [esi + 0x100bd6a4]
cmp dword [ebp + 8], 0x201
je 0x1004be06
mov byte [esi + 0x100bd6a8], 0
cmp eax, 0x1f4
jb 0x1004be70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x100bd6a4], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], edi
call fcn.10052330
add esp, 4
inc edi
mov dword [esp + 0x18], edi
cmp edi, 6
jl 0x1004bcb3
fld dword [0x100bec84]
call fcn.100596f0
fld dword [0x100bec88]
mov esi, eax
call fcn.100596f0
fld dword [0x100bec7c]
mov edi, eax
call fcn.100596f0
fld dword [0x100bec80]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1004be70
cmp byte [0x100bec99], 0
je 0x1004be70
cmp dword [ebp + 8], 0x201
jne 0x1004be2b
mov byte [0x100bec98], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + edi*4 + 0x24]
lea ecx, [edi + edi*8]
mov byte [ecx*8 + 0x100bd6a8], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10058d40
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x1c]
sub eax, dword [0x100bec94]
mov byte [0x100bec98], 0
cmp eax, 0x1f4
jb 0x1004be70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bec94], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], 6
call fcn.10052330
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.10058d40
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bf80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10064018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1004bfc7
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1004c0dc
cmp dword [ebp - 0x1e], 0x36
jne 0x1004c0dc
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x100a25f4
je 0x1004c007
mov esi, 0x100a2624
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x100a2654]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x100a2658]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x100a265c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x100a2660]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x100a2654]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x100a2658]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x100a265c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x100a2660]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x100a2654]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x100a2658]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x100a265c]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x100a2660]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.10058d40
mov esp, ebp
pop ebp
ret 8
Function at 0x1004d8e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1004d870
push 5
sub eax, 0x836486
xor edi, edi
push 0x836481
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004d93f
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x836481
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x836481
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004d945
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, fcn.1004d820
push 5
sub ecx, 0x7dd309
push 0x7dd304
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004d995
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x7dd304
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x7dd304
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004d99b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, fcn.1004d820
push 5
sub edx, 0x833b0d
push 0x833b08
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004d9eb
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x833b08
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x833b08
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004d9f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004f380
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1004f400
push 5
sub eax, 0x80f9b0
xor edi, edi
push 0x80f9ab
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004f3df
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x80f9ab
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x80f9ab
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004f3e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100cd050], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret