joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5042ae
Capabilities:
Write file on windows

Disassembly:
inc edi
outsb dx, byte [esi]
mov dword [ebp - 0xb2c], eax
jnp 0x5042f8
mov dword [ebp - 0x24], edx
push edi
pop ebx
dec edx
mov eax, esi
jne 0x5042c7
mov dword [ebp - 0x20], ecx
jns 0x504317
pop esi
pop edx
pop ebp
jmp 0x50430e
push eax
pop ecx
push ebp
imul esp, dword [ebp + 0x66], 0x40
inc esi
dec ecx
inc ebp
pop edi
jnp 0x504363
call 0x504376
pop edi
push eax
insb byte es:[edi], dx
insb byte es:[edi], dx
call 0x5043ed
insb byte es:[edi], dx
dec edi
push ebp
pop esi
pop esi
pop eax
push ecx
push 0xd60f666e
pop esp
and al, 4
push esi
pop ebp
push ebp
imul ebp, dword [ebx + edi*2 + 0x6a], 0x7d836755
or byte [eax], al
cli
or eax, dword [eax]
push esi
jmp 0xc95ceaf
pop edx
pushal
js 0x5043c3
insb byte es:[edi], dx
insb byte es:[edi], dx
and edx, edi
push edi
imul ecx, dword [ebp + 0x5d], 0x66
pcmpeqb mm1, mm3
or edi, 0xffffffff
push dword [esp]
add dword [esp], 0xfffaec5a
add dword [esp + 4], 0xfb
ret
push edx
pop eax
pop ebx
dec ecx
dec eax
inc eax
insd dword es:[edi], dx
dec edx
insb byte es:[edi], dx
dec esp
pop ebp
pop ebx
pop eax
dec dx
dec esi
imul ebx, dword [eax + 0x68], 0x4b4f5252
push eax
inc edi
inc eax
imul ebp, dword [ecx + 0x64], 0x61
pop ecx
pop ebx
dec ebp
push ebp
insd dword es:[edi], dx
push ebx
dec ebp
push esp
inc esi
inc eax
push ebp
pop eax
pop esp
pushal
jnp 0x50442b
push 0x46
pushal
imul ebx, dword [eax + 0x5a], 0x79
push ebp
pop esp
push eax
pop ebp
pop eax
push esi
pop esp
inc ecx
outsb dx, byte [esi]
inc eax
pop ecx
jnp 0x504446
pop eax
push edi
push 0x6c596155
dec eax
cmp ebx, 0xf4f5e4a9
jne 0x504436
pop ecx
js 0x504475
pop ebp
dec ebp
insd dword es:[edi], dx
or eax, ebx
mov eax, edi
or edx, eax
js 0x504483
dec esp
popal
inc ecx
pop ebx
jae 0x504433
mov eax, dword [ebp + 8]
cmp ecx, 0x73
mov dword [ecx + 0xc], eax
imul esp, dword [ecx + 0x48], 0xc3fc4589
jae 0x5043b6
inc ecx
or al, 0x69
popal
dec eax
mov dword [ebp - 4], eax
inc ebp
cld
ret
pop ecx
cmp edx, 0xfecf3481
je 0x50445c
pop esi
cmp dword [esp + 0x20], 0xfe3d86b9
jne 0x504475
cmp eax, 0xe92b75fe
inc ebp
pop edi
inc ecx
bound esi, qword [edx + edi*4 + 0x6a]
pop edx
pop ecx
pop esp
insd dword es:[edi], dx
jns 0x5044a0
jmp 0x6291a394
push eax
jmp 0x64a198bb
push ecx
dec eax
dec ebx
arpl word [ebx + 0x56], bp
mov ebp, esp
inc esp
pop ebp
inc edi
pop eax
push edi
jmp 0x529eb0e6
pop ebp
ret
xchg esi, eax
or al, 0
add byte [esi - 0x64], ah
lea esp, [esp - 4]
mov dword [esp], eax
call 0x5044c2
dec ebx
outsd dx, dword [esi]
push ebp
inc edx
Function at 0x5043ed
Capabilities:
Write file on windows

Disassembly:
inc edi
outsb dx, byte [esi]
mov dword [ebp - 0xb2c], eax
jnp 0x5042f8
mov dword [ebp - 0x24], edx
push edi
pop ebx
dec edx
mov eax, esi
jne 0x5042c7
mov dword [ebp - 0x20], ecx
jns 0x504317
pop esi
pop edx
pop ebp
jmp 0x50430e
push eax
pop ecx
push ebp
imul esp, dword [ebp + 0x66], 0x40
inc esi
dec ecx
inc ebp
pop edi
jnp 0x504363
call 0x504376
pop edi
push eax
insb byte es:[edi], dx
insb byte es:[edi], dx
call 0x5043ed
insb byte es:[edi], dx
dec edi
push ebp
pop esi
pop esi
pop eax
push ecx
push 0xd60f666e
pop esp
and al, 4
push esi
pop ebp
push ebp
imul ebp, dword [ebx + edi*2 + 0x6a], 0x7d836755
or byte [eax], al
cli
or eax, dword [eax]
push esi
jmp 0xc95ceaf
pop edx
pushal
js 0x5043c3
insb byte es:[edi], dx
insb byte es:[edi], dx
and edx, edi
push edi
imul ecx, dword [ebp + 0x5d], 0x66
pcmpeqb mm1, mm3
or edi, 0xffffffff
push dword [esp]
add dword [esp], 0xfffaec5a
add dword [esp + 4], 0xfb
ret
push edx
pop eax
pop ebx
dec ecx
dec eax
inc eax
insd dword es:[edi], dx
dec edx
insb byte es:[edi], dx
dec esp
pop ebp
pop ebx
pop eax
dec dx
dec esi
imul ebx, dword [eax + 0x68], 0x4b4f5252
push eax
inc edi
inc eax
imul ebp, dword [ecx + 0x64], 0x61
pop ecx
pop ebx
dec ebp
push ebp
insd dword es:[edi], dx
push ebx
dec ebp
push esp
inc esi
inc eax
push ebp
pop eax
pop esp
pushal
jnp 0x50442b
push 0x46
pushal
imul ebx, dword [eax + 0x5a], 0x79
push ebp
pop esp
push eax
pop ebp
pop eax
push esi
pop esp
inc ecx
outsb dx, byte [esi]
inc eax
pop ecx
jnp 0x504446
pop eax
push edi
push 0x6c596155
dec eax
cmp ebx, 0xf4f5e4a9
jne 0x504436
pop ecx
js 0x504475
pop ebp
dec ebp
insd dword es:[edi], dx
or eax, ebx
mov eax, edi
or edx, eax
js 0x504483
dec esp
popal
inc ecx
pop ebx
jae 0x504433
mov eax, dword [ebp + 8]
cmp ecx, 0x73
mov dword [ecx + 0xc], eax
imul esp, dword [ecx + 0x48], 0xc3fc4589
jae 0x5043b6
inc ecx
or al, 0x69
popal
dec eax
mov dword [ebp - 4], eax
inc ebp
cld
ret
pop ecx
cmp edx, 0xfecf3481
je 0x50445c
pop esi
cmp dword [esp + 0x20], 0xfe3d86b9
jne 0x504475
cmp eax, 0xe92b75fe
inc ebp
pop edi
inc ecx
bound esi, qword [edx + edi*4 + 0x6a]
pop edx
pop ecx
pop esp
insd dword es:[edi], dx
jns 0x5044a0
jmp 0x6291a394
push eax
jmp 0x64a198bb
push ecx
dec eax
dec ebx
arpl word [ebx + 0x56], bp
mov ebp, esp
inc esp
pop ebp
inc edi
pop eax
push edi
jmp 0x529eb0e6
pop ebp
ret
xchg esi, eax
or al, 0
add byte [esi - 0x64], ah
lea esp, [esp - 4]
mov dword [esp], eax
call 0x5044c2
dec ebx
outsd dx, dword [esi]
push ebp
inc edx

Function at 0x5045c9
Capabilities:
Write file on windows

Disassembly:
lock xchg dword [esp], edx
lea esp, [esp + 4]
push edi
lea edi, [esp + 0xa]
and al, 0xa
add byte [eax], al
add byte [ecx - 0x18], dl
add byte [eax], al
add byte [eax], al
Function at 0x504cde
Capabilities:
Parse pe header

Disassembly:
add byte [ecx + 0x50], dl
mov ebp, esp
fstp qword [esp]
je 0x504d46
push ebx
je 0x504d03
call fcn.00508239
mov edi, dword [ebp + 0xc]
pop ecx
push 0x7845000a
pop edi
dec edi
imul eax, dword [ecx - 0x75], 0x4d
fadd qword [esp + ecx*2 + 0x1b]
rol byte [eax], 0x78
push esp
imul edi, dword [eax + 0x6b], 0x546f5a6a
push ebp
jne 0x504d13
frndint
test eax, eax
je 0x504d8a
jmp 0x532440
sub al, 0x24
mov ebp, 0x1b635e52
in al, 0xf0
xchg dword [esp + 0xa], edx
inc esi
push esp
dec esi
push ebp
push 0x247c816e
jo 0x504d34
outsd dx, dword [esi]
mov ebx, 0x9b6375e1
jne 0x504daa
jmp 0x504e17
sar dword [eax + 0xf], 0x84
ror byte [ebp + 0x48650476], cl
or eax, dword [eax]
sub al, 0x41
jns 0x504e2e
xor dword [eax + 0x4c], ebp
dec esp
jmp 0x63979839
or dh, byte [edx + ebx - 0x17]
xchg dword [eax], eax
add byte [eax], al
cmp byte [ecx + 4], 0
jne 0x5050ef
popfd
push 0x68784644
inc esp
arpl word [eax + eax*8 + 0x635c5253], ax
push eax
mov eax, dword [eax]
fld qword [ebp + 8]
push edx
jmp 0x504f12
add byte [esi - 0x63], ah
Function at 0x537cb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
dec edx
insb byte es:[edi], dx
push ecx
outsd dx, dword [esi]
js 0x537d09
inc edi
pushal
dec ebx
bound ecx, qword [ebx + 0x61]
push ebp
push esp
pop ecx
push eax
push eax
bound ecx, qword [eax + 0x5b]
inc eax
bound ecx, qword [edi + 0x51]
cmp dword [esp + 0x34], 0xfb81cf31
je 0x5c1eb7
xor esi, esi
pushfd
lea esp, [esp - 4]
mov word [esp], cs
call fcn.00537d1b
sub eax, 0
mov al, byte [edx + eax + 0x2c]
push ebp
outsb dx, byte fs:[esi]
mov eax, dword [ecx]
xor ecx, ecx
push edx
insb byte es:[edi], dx
inc di
pop esi
dec esp
push edi
or dword [eax], eax
jnp 0x537d76
arpl word [esi + ecx*2 + 0x63], sp
dec esp
int1
add ecx, dword [esi + 0x55]
dec esi
arpl word [ecx + esi*8 + 3], cx
dec esi
push ebp
inc esp
js 0x537d45
inc ebp
clc
pop ebp
jnp 0x537d6a
ret
push edx
arpl word [esi + 0x55], cx
dec eax
pop esi
bound ecx, qword [edx + 0x6b]
outsd dx, dword [esi]
jnp 0x537db0
imul ebx, dword [ecx + 0x61], 0x4d
inc edx
push edx
pop eax
dec esi
insd dword es:[edi], dx
push ecx
bound eax, qword [edx + 0x55]
pop esi
pop ebp
inc edi
inc ebp
dec esi
push 0x5c605262
push edx
dec ecx
pop edx
dec ebx
dec bp
bound ebp, qword [edx + 0x64]
pop edx
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
pop ebp
push eax
jns 0x537de6
dec esi
dec ebp
insb byte es:[edi], dx
inc ecx
jns 0x537dda
pushal
push ecx
pop edi
pop esp
dec edx
pop di
dec esp
dec esi
dec eax
push 0x6a
dec eax
arpl word fs:[ebp + 0x78], bx
popal
pushal
pop eax
dec ecx
pop eax
inc ebp
popal
inc eax
dec edx
pop esi
pop esi
dec edi
pop eax
outsd dx, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
push eax
push ebp
push 0xffffffffffffffb6
push pe_nt_image_headers32
push ax
lahf
lock xchg word [esp], ax
push edi
call 0x537df3
pop esi
push edx
pop eax
dec ecx
dec esi
inc ebp
imul ebp, dword [edx + 0x6b], 0x69
dec esi
dec edx
pop edx
jnp 0x537e3a
dec ebx
pushal
push ebp
dec edi
pop eax
dec eax
inc esi
inc edx
popal
pop ebx
dec esi
inc eax
dec esi
outsd dx, dword [esi]
inc eax
inc ebp
outsd dx, dword [esi]
push 0x65
dec eax
push esp
inc ebp
jns 0x537e37
dec ecx
insb byte es:[edi], dx
push edi
inc esi
insd dword es:[edi], dx
push edx
pop ebp
push esi
pop ecx
jnp 0x537e61
mov edi, dword fs:[esp]
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], ebx
mov ebx, 0xe5
cmove ebx, dword [esp + 0xa]
add edi, ebx
lock xchg dword [esp + 0xa], edi
pop ebx
lock xchg dword [esp], edi
invalid
invalid

Function at 0x537d1b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [esp], 0xfbc
cmp ebx, 0x599fcff6
jne 0x537d25
iretd
pop edi
dec eax
imul ebp, dword [ecx + 0x4b], 0x5b
popal
imul ebp, dword [esi + 0x47], 0x50
pop esi
push eax
dec ecx
popal
dec eax
pop ebp
push ecx
push cx
dec ebp
inc esp
push 0x41666942
Function at 0x53b265
Capabilities:
Write file on windows

Disassembly:
cmp edi, 0x165bca3d
je 0x553263
push 8
cmp dword [esp], 0xe3f161f5
je 0x53b28f
call 0x53b265
jne 0x53b249
outsb dx, byte [esi]
inc eax
inc eax
pop ebx
outsd dx, dword [esi]
dec ecx
lea eax, [ebp - 0x1d0]
scasb al, byte es:[edi]
inc edx
arpl word [ecx + 0x12], bx
test dword [eax], esi
invalid
add byte [edx + 0x42], ah
push ecx
inc ecx
outsb dx, byte [esi]
jnp 0x53b2ca
imul edx, dword [ebx + 0x6e], 0xffffffe9
rcr byte [edi + 0x6d], 1
add dword [esp], 0xffee54a8
cmp dword [esp + 0x68], 0x64ff5e73
jne 0x53b2d9
mov word [esi], ax
inc eax
test ecx, ecx
push eax
bound edx, qword [ebx + 0x60]
into
jmp 0xc24b79c2
jns 0x53b30c
push eax
push 0x52
outsb dx, byte [esi]
dec edi
inc edi
inc edi
insd dword es:[edi], dx
je 0x53b2d0
outsd dx, dword [esi]
push 0x57
push 0x42
push eax
cmpeqsd xmm2, xmm0
shr dword [ebp + 0x40], 0x12
bound ecx, qword [edi + edi*8 + 0x75]
fmul dword [ebp + 0x7b638045]
imul eax, dword [ebx - 0x3e081f1f], 0
add al, 0
add byte [ebx + 0x41], bl
pop ecx
dec edx
push dword [eax]
dec edx
inc ebp
dec eax
insb byte es:[edi], dx
dec esi
push ecx
popal
inc ebp
call 0x53b306
add byte [eax + edi*2 + 0x44], al
inc esp
js 0x53b318
inc esp
cmp dword [ebp + 0xc], ecx
inc edx
call fcn.0053b33b
test edi, edi
test eax, eax
jnp 0x53b35c
dec eax
pop esp
inc esi
dec eax
jns 0x53b34f
dec esi
push 0x47
inc esp
outsb dx, byte [esi]
pop ebx
fabs
pop ecx
popal
push esp
pop esp
dec edi
inc ebx
sub ecx, 1
mov eax, dword [esp + 0xc]
pop ebp
pop edi
imul ecx, ecx, 0x38
mov esi, dword [ebp + 0x10]
inc ebx
jns 0x53b297
inc ebp
or byte [edi + 0x52], ah
push edx
lea esi, [ecx + 8]
cmp dword [ebp - 0x3a4], 0
jmp 0x5d97da
imul esp, dword [ecx + 0x46], 0x3b537850
ret 0x5558
or al, 0
insb byte es:[edi], dx
dec eax
dec ebx
dec ebx
dec eax
push eax
pop esp
inc eax
push ecx
pop ecx
pop esp
push esi
add byte [esi + 0x68], dl
jnp 0x53b3d7
dec esp
js 0x53b3ce
inc eax
push 0x57606352
dec ebx
test ebx, ebx
push edi
jns 0x53b3c5
insd dword es:[edi], dx
push ecx
push 0x8b307f8d
into
inc eax
push esp
dec esp
inc ebx
push edx
inc ecx
inc ecx
mov cx, si
ret
add byte [edi + ebp*2 + 0x46], ah
imul ebx, dword [edi + 0x48], 0x6a664369
push esi
push 0x64
push esi
pop ebx
jne 0x53b3d8
dec esi
imul ebp, dword [ecx + 0x79], 0x46
imul edi, dword [ecx + 0x46], 0x585e455e
jns 0x53b420
pop esi
inc ebp
pop esi
pop eax
bound edx, qword [edi - 0x3f]
loop 0x53b3e9
dec esi
pop esp
push ebx
push ecx
dec ebx
arpl di, di
jne 0x53b414
push dword [ebp + 0x28]
inc edx
dec edx
jnp 0x53b455
lea ecx, [ebp - 0x740]
ret
add byte [eax], al
add byte [ecx + 0xe8242c], cl
add byte [eax], al
add byte [ecx - 0x3276dbec], cl
adc al, 0x24
insb byte es:[edi], dx
add byte [eax], al
add byte [eax - 0x7d], dl
test dword [ecx], 0x15ffd88b
jl fcn.0053b403
inc ecx
add byte [edi + 0x61], cl
and al, 0x8d
and al, 4
Function at 0x10001000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10014770
push 0x10006610
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x100010a3
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x100010a3
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x100010a3
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x100010a3
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi - 0x7ff80000]
cmp esi, 0x7ff80000
ja 0x1000115e
mov ebx, 0x10000
lea edi, [esi + 0x7ff80000]
cmp esi, 0x80000000
jb 0x10001171
mov edi, 0xfff80000
mov eax, dword [0x1001bff4]
mov ecx, dword [0x1001bffc]
mov dword [ebp - 4], edi
test eax, eax
jne 0x1000118e
test ecx, ecx
je 0x100011a1
mov eax, ecx
mov dword [0x1001bff4], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x100011a1
cmp edx, ebx
jb 0x100011a1
cmp edx, edi
jbe 0x1000130f
mov eax, ecx
mov dword [0x1001bff4], eax
test ecx, ecx
je 0x100011cf
test eax, eax
je 0x100011c3
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100011c3
cmp ecx, ebx
jb 0x100011c3
cmp ecx, edi
jbe 0x1000130f
mov eax, dword [eax + 4]
mov dword [0x1001bff4], eax
test eax, eax
jne 0x100011b0
movzx eax, si
sub esi, eax
mov edi, esi
cmp esi, ebx
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
jbe 0x10001245
lea eax, [edi - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x3c]
push 0x1c
cmovbe edi, edx
push eax
push edi
call ecx
test eax, eax
je 0x1000123f
cmp dword [ebp - 0x2c], 0x10000
jne 0x10001212
cmp dword [ebp - 0x30], 0x10000
jae 0x1000121f
mov edi, dword [ebp - 0x38]
add edi, 0xffff0000
cmp edi, ebx
jmp 0x100011d8
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1001bff4], eax
test eax, eax
jne 0x100012d6
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [ebp - 4]
cmp esi, edi
jae 0x1000133a
lea eax, [esi - 0x70000000]
mov edx, 0x80010000
cmp eax, 0x10000000
lea eax, [ebp - 0x20]
push 0x1c
cmovbe esi, edx
push eax
push esi
call ecx
test eax, eax
je 0x1000133a
cmp dword [ebp - 0x10], 0x10000
jne 0x100012bf
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10000
jb 0x100012c2
movzx edx, si
test edx, edx
je 0x100012a3
mov esi, dword [ebp - 0x20]
mov eax, 0x10000
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], esi
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1001bff4], eax
test eax, eax
jne 0x100012d9
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, ecx
cmp esi, edi
jae 0x1000133a
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x10001250
mov edi, dword [ebp - 4]
mov ecx, dword [0x1001bffc]
xor edx, edx
mov dword [eax + 4], ecx
mov esi, 0x7fd
mov dword [eax], 0x52727464
lea ecx, [eax + 0xffe0]
mov dword [eax + 8], 0
mov dword [0x1001bffc], eax
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x10001301
mov dword [eax + 8], edx
mov edx, dword [eax + 8]
cmp edx, ebx
jb 0x1000133a
cmp edx, edi
ja 0x1000133a
mov ecx, dword [edx + 0x18]
movdqa xmm0, xmmword [0x10014610]
pop edi
mov dword [eax + 8], ecx
mov eax, edx
pop esi
movdqu xmmword [edx], xmm0
pop ebx
movdqu xmmword [edx + 0x10], xmm0
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1001c000], 0
je 0x10001466
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x1001c000
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x1000145d
push esi
mov esi, dword [0x1001bffc]
mov dword [0x1001c008], eax
mov dword [0x1001bff8], eax
mov dword [0x1001bff0], eax
mov dword [0x1001c004], eax
mov dword [0x1001bfec], eax
test esi, esi
je 0x100014c6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [esp]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x100014b0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100014d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001c000], eax
je 0x100014ed
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [0x1001bff8]
push edi
test esi, esi
je 0x10001556
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call ebx
cmp dword [esi + 4], 0
jne 0x10001545
mov edx, dword [esi + 0x10]
test edx, edx
je 0x10001545
mov ecx, edx
xorps xmm0, xmm0
and ecx, 0xffff0000
movdqu xmmword [edx], xmm0
movdqu xmmword [edx + 0x10], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 0x18], eax
mov dword [ecx + 8], edx
mov dword [esi + 0x10], 0
mov edi, dword [esi]
push esi
call fcn.1000264c
add esp, 4
mov esi, edi
test edi, edi
jne 0x10001500
mov esi, dword [0x1001bffc]
mov dword [0x1001bff8], 0
test esi, esi
je 0x10001585
lea ebx, [ebx]
lea eax, [ebp - 8]
push eax
push 0x20
push 0x10000
push esi
call ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x10001570
mov edi, dword [0x1001bff0]
test edi, edi
je 0x100015ab
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [edi + 4]
call ebx
mov esi, dword [edi]
push edi
call fcn.1000264c
add esp, 4
mov edi, esi
test esi, esi
jne 0x10001595
pop edi
pop esi
mov dword [0x1001bff0], 0
xor eax, eax
mov dword [0x1001c000], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001910
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x1001c004]
push edi
mov edi, ecx
test eax, eax
jne 0x10001985
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, eax
jne 0x1000192a
xor eax, eax
pop edi
ret
push esi
push 8
call fcn.10002677
mov esi, eax
add esp, 4
test esi, esi
jne 0x10001940
lea edi, [eax + 8]
jmp 0x1000195d
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001972
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.1000264c
add esp, 4
pop esi
mov dword [0x1001c004], edi
mov eax, edi
mov dword [0x1001bfec], 0
pop edi
ret
mov eax, dword [0x1001bff0]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], edi
mov dword [0x1001bff0], esi
pop esi
pop edi
ret
Function at 0x10001bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001c000], eax
je 0x10001bf4
mov eax, 0x10dd
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1001c004]
test eax, eax
jne 0x10001ce0
test ebx, ebx
je 0x10001c19
cmp dword [ebx], eax
jne 0x10001c23
mov dword [0x1001c004], 6
mov dword [0x1001bfec], ebx
mov eax, 6
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x18
call fcn.10002677
mov esi, eax
add esp, 4
test esi, esi
jne 0x10001c3d
lea edi, [eax + 8]
jmp 0x10001cc3
mov ecx, dword [ebp - 8]
mov edi, dword [ebx]
call fcn.10001400
movzx ecx, byte [edi + 0x17]
mov edx, eax
mov eax, dword [edi + 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x10001cb5
cmp ecx, 0x17
ja 0x10001cb5
cmp dword [edi + 0x1c], edx
jne 0x10001cb5
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001c86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10001cc3
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov dword [esi + 4], 1
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x1001bff8]
pop edi
mov dword [esi], eax
xor eax, eax
mov dword [0x1001bff8], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x1001c008], 0
mov edi, 9
jne 0x10001cc9
mov dword [0x1001c004], edi
test esi, esi
je 0x10001cd6
push esi
call fcn.1000264c
add esp, 4
mov eax, edi
mov dword [0x1001bfec], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100022f0
Capabilities:
Read .ini file

Disassembly:
push str..__ini__ImmortalsConfig.ini
push 0x385
push str.Value
push 0x100145d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp byte [0x1001c00c], 0
jne 0x1000231a
mov ecx, eax
jmp fcn.100022b0
ret
Function at 0x10002450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
sub eax, 0
je 0x100025b2
dec eax
jne 0x10002633
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str..__ini__ImmortalsConfig.ini
push 0
push 0x10014604
push str.Server
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x100024a7
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x100021d0
jmp 0x100024c0
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x10002240
sub esp, 0xc
mov ecx, 0x100171c4
call fcn.10001990
call fcn.100015d0
push ebx
push edi
mov dword [0x1001c010], 0x772893
call fcn.10001450
call esi
mov ecx, eax
call fcn.10001910
sub esp, 0xc
mov edx, 0x10002340
mov ecx, 0x100171c0
call fcn.10001990
sub esp, 0xc
mov edx, 0x10002370
mov ecx, 0x1001c010
call fcn.10001990
call fcn.100015d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push 4
push 0x7728da
call esi
lea eax, [ebp + 0xc]
mov dword [0x7728da], 0x909004eb
push eax
push dword [ebp + 0xc]
push 4
push 0x7728da
call esi
lea eax, [ebp + 0xc]
push eax
push 0x40
push 1
push 0x5f1460
call esi
lea eax, [ebp + 0xc]
mov byte [0x5f1460], 0xc3
push eax
push dword [ebp + 0xc]
push 1
push 0x5f1460
call esi
lea eax, [ebp + 0xc]
mov edi, 0x9453b8
push eax
push 0x40
push 1
push edi
lea ebx, [edi + 0x14]
call esi
lea eax, [ebp + 0xc]
mov byte [edi], 0x19
push eax
push dword [ebp + 0xc]
push 1
push edi
call esi
lea eax, [ebp + 0xc]
push eax
push 0x40
push 1
push ebx
call esi
lea eax, [ebp + 0xc]
mov byte [ebx], 0x19
push eax
push dword [ebp + 0xc]
push 1
push ebx
call esi
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
ret 0xc
push str..__ini__ImmortalsConfig.ini
push 0
push 0x10014604
push str.Server
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x100025e9
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x100021d0
jmp 0x10002602
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x10002240
mov ecx, 0x100171c4
call fcn.10001bd0
call fcn.100015d0
call fcn.10001450
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x10002340
mov ecx, 0x100171c0
call fcn.10001bd0
call fcn.100015d0
mov eax, 1
pop esi
pop ebp
ret 0xc