joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451a00
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4fa57c]
cmp dword [eax + 0x30], 0
je 0x451aaa
cmp dword [ebx + 0x94], 0
jne 0x451aa4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x451990
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x451aa4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x451a6a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x451aa4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414140
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x451a79
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4527c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4527f9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404754
jmp 0x452806
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046b8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x453b68
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x453bd6
mov eax, esi
call fcn.0043e3f8
test al, al
je 0x453bd6
mov eax, dword [ebx + 0x84]
call fcn.0043e084
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x453bd6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x453bca
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e084
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004364b0
jmp 0x453bd6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004539a4
pop esi
pop ebx
ret
Function at 0x454d8c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b18
mov eax, dword [ebp - 8]
call fcn.00404b18
xor eax, eax
push ebp
push 0x454e52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b28
mov esi, eax
push esi
call sub.kernel32.dll_LoadLibraryA
test eax, eax
push esi
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [0x4fa630], eax
mov eax, dword [ebp - 8]
call fcn.00404b28
push eax
mov eax, dword [0x4fa630]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4fa634], eax
push 0x4fa62c
push 0x40
push 0x3d08fc
push 0x4fa634
call sub.kernel32.dll_VirtualProtect
mov edx, 0x4fa634
mov eax, 0x45d754
mov ecx, 4
call fcn.00402e7c
mov edx, 0x4fa634
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.00454d70
mov eax, dword [0x4fa630]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454e59
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404688
ret
Function at 0x413faf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e020]
jne 0x413fb9
repz ret
jmp fcn.004141a0

Function at 0x415f59
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00414613
and dword [ebp - 4], 0
cmp dword [0x443430], 0
mov ebx, eax
jne 0x41600a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4160bb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41b874
push edi
call esi
test eax, eax
je 0x4160bb
push eax
call fcn.004145a1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443430], eax
call esi
push eax
call fcn.004145a1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x443434], eax
call esi
push eax
call fcn.004145a1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x443438], eax
call esi
push eax
call fcn.004145a1
pop ecx
mov dword [0x443440], eax
test eax, eax
je 0x41600a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004145a1
pop ecx
mov dword [0x44343c], eax
mov eax, dword [0x44343c]
cmp eax, ebx
je 0x416062
cmp dword [0x443440], ebx
je 0x416062
push eax
call fcn.0041461c
push dword [0x443440]
mov esi, eax
call fcn.0041461c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416062
test edi, edi
je 0x416062
call esi
test eax, eax
je 0x416059
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416059
test byte [ebp - 0xc], 1
jne 0x416062
or dword [ebp + 0x10], 0x200000
jmp 0x41609b
mov eax, dword [0x443434]
cmp eax, ebx
je 0x41609b
push eax
call fcn.0041461c
pop ecx
test eax, eax
je 0x41609b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41609b
mov eax, dword [0x443438]
cmp eax, ebx
je 0x41609b
push eax
call fcn.0041461c
pop ecx
test eax, eax
je 0x41609b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443430]
call fcn.0041461c
pop ecx
test eax, eax
je 0x4160bb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4160bd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402930
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x42c050]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
push 0x802
call fcn.0040cf39
add esp, 4
mov ebx, eax
mov dword [esp + 0xc], ebx
push 0x802
push 0
push ebx
call fcn.00409050
add esp, 0xc
push 0x800
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.00401050
push 0x42972c
add eax, 2
push 0x800
push eax
call fcn.0040bf04
add esp, 0xc
lea ecx, [esp + 0x70]
push ebx
call fcn.00403960
push ecx
push ebx
lea ecx, [esp + 0x30]
call fcn.00403960
mov edx, eax
lea ecx, [esp + 0x5c]
call fcn.00405990
add esp, 4
lea ecx, [esp + 0x28]
call fcn.00403910
push ebx
lea ecx, [esp + 0x44]
call fcn.00403960
push ecx
lea ecx, [esp + 0x8c]
call fcn.00402bd0
sub esp, 0xc
lea eax, [esp + 0x64]
lea ecx, [esp + 0x94]
push eax
call fcn.00403810
lea ecx, [esp + 0x88]
call fcn.004037d0
test al, al
je 0x402b50
push 0x802
push 0
push ebx
call fcn.00409050
add esp, 4
lea ecx, [esp + 0x90]
push ebx
call fcn.00403850
lea ecx, [esp + 0x88]
call fcn.004037b0
push ebx
lea ecx, [esp + 0x2c]
call fcn.00403960
push eax
lea ecx, [esp + 0x44]
call fcn.00403900
lea ecx, [esp + 0x28]
call fcn.00403910
push 0x10
call fcn.004075c3
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
push 0x44
movups xmmword [ebx], xmm0
call fcn.004075c3
add esp, 4
mov edi, eax
push 0x44
push 0
push edi
call fcn.00409050
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.004038f0
lea ecx, [esp + 0x40]
mov esi, eax
call fcn.004038f0
push ebx
push edi
push esi
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x402af3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x10]
call fcn.00402910
push eax
mov edx, str.Failed_to_launch_game._nError_code:
lea ecx, [esp + 0x2c]
call fcn.004059c0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00403910
push 0x10
push str.Error
lea ecx, [esp + 0x30]
call fcn.004038f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x28]
call fcn.00403910
mov ebx, dword [esp + 0xc]
push 0x802
push 0
push ebx
call fcn.00409050
add esp, 0xc
push ebx
call fcn.0040c877
add esp, 4
lea ecx, [esp + 0x88]
call fcn.00402bb0
lea ecx, [esp + 0x40]
call fcn.00403910
lea ecx, [esp + 0x58]
call fcn.00403910
lea ecx, [esp + 0x70]
call fcn.00403910
mov ecx, dword [esp + 0x144]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004075b5
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x10]
call fcn.00402910
push eax
mov edx, str.Failed_to_read_launch_data._nError_code:
lea ecx, [esp + 0x2c]
call fcn.004059c0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00403910
push 0x10
push str.Error
lea ecx, [esp + 0x30]
call fcn.004038f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x28]
call fcn.00403910
jmp 0x402af7
Function at 0x403240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
call fcn.00404af0
mov bx, ax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2c]
movzx ecx, bx
push eax
mov dword [ebp - 0x2c], ecx
call fcn.00404b30
add esp, 8
test al, al
je 0x403290
lea ecx, [ebp + 8]
call fcn.00404b00
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004075b5
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.00403f50
test eax, eax
je 0x4032d7
call fcn.00403f10
mov edx, eax
call fcn.00403f50
cmp eax, edx
jae 0x4032d7
call fcn.00403ea0
mov esi, eax
lea eax, [ebp + 8]
push eax
call fcn.004033d0
add esp, 4
mov word [esi], ax
mov ax, word [ebp + 8]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004075b5
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x4033b6
mov ecx, esi
call fcn.00403c90
mov edi, dword [esi + 0x38]
lea eax, [ebp + 8]
push eax
call fcn.004033d0
add esp, 4
test edi, edi
jne 0x403328
mov edx, dword [esi + 0x4c]
mov ecx, eax
call fcn.004028d0
test al, al
movzx eax, word [ebp + 8]
jne 0x4033b9
pop edi
pop esi
movzx eax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004075b5
mov esp, ebp
pop ebp
ret 4
movzx eax, ax
mov ecx, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call fcn.00401c70
sub eax, 0
je 0x403389
sub eax, 1
je 0x403389
sub eax, 2
jne 0x4033b6
mov edx, dword [esi + 0x4c]
mov ecx, dword [ebp - 0x28]
call fcn.004028d0
test al, al
movzx eax, word [ebp + 8]
jne 0x4033b9
pop edi
pop esi
movzx eax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004075b5
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4033a6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040c60c
add esp, 0x10
cmp edi, eax
jne 0x4033b6
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
mov ax, word [ebp + 8]
jne 0x4033b9
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004075b5
mov esp, ebp
pop ebp
ret 4
Function at 0x403cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x403dd3
cmp byte [ebx + 0x3e], 0
je 0x403dd3
mov eax, dword [ebx]
push esi
push edi
mov esi, dword [eax + 0xc]
call fcn.00404af0
movzx edi, ax
mov ecx, ebx
push edi
call esi
movzx ecx, ax
mov eax, edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
push eax
call fcn.00404b30
add esp, 8
test al, al
jne 0x403dc0
mov ecx, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.00401c80
sub eax, 0
je 0x403d87
sub eax, 1
je 0x403d8b
sub eax, 2
jne 0x403dc0
pop edi
mov byte [ebx + 0x3e], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004075b5
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3e], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x403da8
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.0040c60c
add esp, 0x10
cmp esi, eax
jne 0x403dc0
cmp byte [ebx + 0x3e], 0
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004075b5
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004075b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.004075b5
mov esp, ebp
pop ebp
ret

Function at 0x412b0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004127c0

Function at 0x412b1a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041294a
Function at 0x1000cb20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0x401000
call fcn.1000cd00
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.1000dad0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000cb81
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x1000cb93
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.1000da60
cmp eax, 0x16197be9
jne 0x1000cbae
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.1000da60
cmp eax, 0x94bf
jne 0x1000cbc9
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.1000da60
cmp eax, 0x94bf
jne 0x1000cbe4
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.1000da60
cmp eax, 0x94bf
jne 0x1000cbff
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.1000da60
cmp eax, 0x3539f633
jne 0x1000cc1a
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.1000da60
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x1000d370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
mov dword [ebp - 0x10], 0
cmp byte [ebp + 0x14], cl
cmovne ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x1000d38f
mov byte [ebp - 4], cl
jmp 0x1000d3ac
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1005caa0
add esp, 0xc
cmp byte [ebp - 4], 0
je 0x1000d3da
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x1000d3e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov eax, esi
mov dword [ebp - 4], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub eax, 1
je 0x1000d414
sub eax, 1
je 0x1000d469
sub eax, 2
je 0x1000d4c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
sub bl, al
movzx ecx, byte [ebp + 0x14]
dec bl
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], 0
test ecx, ecx
jne 0x1000d434
mov byte [ebp - 0xc], cl
mov byte [eax], bl
jmp 0x1000d466
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x18], eax
call edi
mov ecx, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0xc]
mov byte [ecx], bl
test eax, eax
je 0x1000d466
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov ebx, dword [ebp - 4]
mov eax, ebx
mov dword [ebp - 0x18], 0
sub eax, esi
mov esi, dword [ebp + 8]
sub eax, esi
movzx eax, ax
mov dword [ebp - 8], eax
movzx ecx, ax
movzx eax, byte [ebp + 0x14]
add eax, eax
jne 0x1000d493
mov byte [ebp - 0xc], 0
mov word [esi], cx
jmp 0x1000d4c6
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
mov ecx, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0xc]
mov word [esi], cx
test eax, eax
je 0x1000d4c6
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
add eax, esi
sub ebx, eax
mov dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x14]
shl eax, 2
test eax, eax
jne 0x1000d4ee
mov byte [ebp - 0xc], al
mov dword [esi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], ebx
test eax, eax
je 0x1000d51d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
movzx ebx, byte [ebp + 0x10]
mov dword [ebp - 0x14], edx
push esi
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ebx, ebx
jne 0x1000d555
xor cl, cl
jmp 0x1000d570
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push ecx
push 0x40
push ebx
push eax
mov dword [ebp - 0x14], eax
call edi
mov edx, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov ch, byte [esi]
mov byte [ebp + 0x13], ch
test cl, cl
je 0x1000d593
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edx
call edi
mov eax, dword [ebp + 0xc]
mov ch, byte [ebp + 0x13]
movzx ecx, ch
sub ecx, 0xe8
je 0x1000d66c
sub ecx, 1
je 0x1000d66c
sub ecx, 0x16
jne 0x1000d65c
mov dword [ebp - 0x14], ecx
lea esi, [eax + 1]
test ebx, ebx
jne 0x1000d5c2
xor cl, cl
jmp 0x1000d5da
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov dl, byte [esi]
mov byte [ebp + 0x13], dl
test cl, cl
je 0x1000d5ff
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
mov eax, dword [ebp + 0xc]
mov dl, byte [ebp + 0x13]
cmp dl, 0x15
je 0x1000d609
cmp dl, 0x25
jne 0x1000d65c
shl ebx, 2
lea esi, [eax + 2]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test ebx, ebx
jne 0x1000d61c
xor al, al
jmp 0x1000d634
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov esi, dword [esi]
test al, al
je 0x1000d64e
mov eax, dword [ebp - 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl ebx, 2
lea esi, [eax + 1]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test ebx, ebx
jne 0x1000d67f
xor al, al
jmp 0x1000d697
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov ebx, dword [esi]
test al, al
je 0x1000d6b1
mov eax, dword [ebp - 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
lea ecx, [ebx + 4]
pop edi
add ecx, esi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d6d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push ebx
push ecx
mov ecx, esp
push dword [ebp + 8]
mov dword [ecx], eax
call fcn.1000d530
mov esi, dword [ebp + 0xc]
add esp, 0xc
movzx eax, bl
mov dword [ebp - 0x10], 0
test bl, bl
jne 0x1000d708
mov byte [ebp - 4], bl
mov byte [esi], 0xe8
jmp 0x1000d740
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
mov byte [esi], 0xe8
test eax, eax
je 0x1000d740
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push 4
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, esp
push ecx
mov dword [edx], ecx
mov edx, esp
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [edx], ecx
call fcn.1000d3e0
mov eax, dword [ebp + 8]
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d770
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
mov dword [ebp - 0x10], 0
cmp byte [ebp + 0x10], al
push esi
cmovne eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1000d793
mov byte [ebp - 4], al
jmp 0x1000d7ad
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
push dword [ebp + 0xc]
push 0x90
push esi
call fcn.1005d020
add esp, 0xc
cmp byte [ebp - 4], 0
je 0x1000d7db
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret