joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [ecx + 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
push edi
test esi, esi
je 0x1004116d
mov eax, dword [esi + 0x78]
test eax, eax
je 0x10040fda
mov esi, eax
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x10040fd1
mov dword [esp + 0x2c], 0x10016cc0
mov edx, dword [esi + 4]
and edx, 0x2000000
mov dword [esp + 0x28], edx
cmp edx, dword [esp + 0x44]
jne 0x10041162
mov edi, dword [esi + 0x48]
test edi, edi
je 0x10041162
movups xmm0, xmmword [esi + 8]
mov ebx, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
movd eax, xmm0
movups xmmword [esp + 0x30], xmm0
add dword [esp + 0x34], ebp
add dword [esp + 0x38], ebx
add eax, ebx
add dword [esp + 0x3c], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10041070
lea ecx, [esp + 0x30]
mov edx, eax
push ecx
call fcn.1003b8b0
cmp eax, 0xffffffff
je 0x1004115e
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
sub ecx, ebx
mov dword [esp + 0x20], eax
sub eax, ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
sub eax, ebp
sub ebx, ebp
jmp 0x10041080
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x30]
cmp edi, eax
jne 0x10041097
test dword [esi + 4], 0x20000
je 0x10041097
mov edi, dword [esi + 0x34]
test byte [esi + 4], 8
je 0x100410ba
cmp edi, eax
jne 0x100410a6
mov edi, dword [esi + 0x3c]
jmp 0x100410d5
cmp edi, dword [esi + 0x34]
jne 0x100410b0
mov edi, dword [esi + 0x40]
jmp 0x100410d5
cmp edi, dword [esi + 0x38]
jne 0x100410d5
mov edi, dword [esi + 0x44]
jmp 0x100410d5
cmp edi, dword [esi + 0x3c]
jne 0x100410c3
mov edi, eax
jmp 0x100410d5
cmp edi, dword [esi + 0x40]
jne 0x100410cd
mov edi, dword [esi + 0x34]
jmp 0x100410d5
cmp edi, dword [esi + 0x44]
jne 0x100410d5
mov edi, dword [esi + 0x38]
test edi, edi
je 0x1004115e
sub ecx, dword [esp + 0x10]
mov eax, 0x10016cb0
mov ebp, dword [esi + 0x10]
inc ecx
sub ebp, dword [esi + 8]
mov dword [esp + 0x24], ecx
inc ebp
mov ecx, dword [esp + 0x18]
sub ebx, ecx
sub ecx, dword [esi + 0xc]
inc ebx
imul ecx, ebp
sub ecx, dword [esi + 8]
add ecx, dword [esp + 0x10]
add ecx, edi
test byte [esi + 4], 0x20
cmovne eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
test edx, edx
je 0x10041138
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x1004115b
mov eax, dword [0x1013cf04]
push eax
imul eax, dword [esp + 0x38]
add eax, dword [0x51e3fc]
add eax, dword [esp + 0x24]
jmp 0x1004114c
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
push eax
imul eax, dword [esp + 0x1c]
add eax, dword [edx + 0x2c]
add eax, dword [esp + 0x14]
push eax
push ebp
push ebx
push dword [esp + 0x34]
push ecx
call dword [esp + 0x40]
add esp, 0x18
mov dword [esi + 0x48], edi
mov ecx, dword [esp + 0x14]
mov esi, dword [esi + 0x74]
test esi, esi
jne 0x10040fe2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x100416f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
call fcn.10040680
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4d6fd9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100416e0
mov byte [0x4d6fd9], 0xe9
sub eax, 0x4d6fde
mov dword [0x4d6fda], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4d6fd9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov dword [esp], 0x4c8fd1
push eax
lea edx, [esp + 4]
mov dword [esp + 8], 0x4c900d
mov ecx, 0x51e3fc
call fcn.10011f50
add esp, 8
ret

Function at 0x10044390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
movzx eax, byte [0x461594]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1013cda4], eax
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45d880
call esi
mov eax, 0x10044310
mov byte [0x45d880], 0xe9
sub eax, 0x45d885
mov dword [0x45d881], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45d880
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45fd88
call esi
mov eax, 0x10044320
mov byte [0x45fd88], 0xe9
sub eax, 0x45fd8d
mov dword [0x45fd89], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45fd88
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45f838
call esi
mov eax, 0x10044330
mov byte [0x45f838], 0xe9
sub eax, 0x45f83d
mov dword [0x45f839], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45f838
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45ee0c
call esi
mov eax, 0x10044340
mov byte [0x45ee0c], 0xe9
sub eax, 0x45ee11
mov dword [0x45ee0d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45ee0c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x460ba0
call esi
mov eax, 0x10044350
mov byte [0x460ba0], 0xe9
sub eax, 0x460ba5
mov dword [0x460ba1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x460ba0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x461134
call esi
mov eax, 0x10044360
mov byte [0x461134], 0xe9
sub eax, 0x461139
mov dword [0x461135], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x461134
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x461454
call esi
mov eax, 0x10044370
mov byte [0x461454], 0xe9
sub eax, 0x461459
mov dword [0x461455], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x461454
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4614cc
call esi
mov eax, 0x10044380
mov byte [0x4614cc], 0xe9
sub eax, 0x4614d1
mov dword [0x4614cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4614cc
call esi
pop esi
pop ecx
ret
Function at 0x10044b40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x470650
call esi
mov eax, 0x10044b20
mov byte [0x470650], 0xe9
sub eax, 0x470655
mov dword [0x470651], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x470650
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4705a0
call esi
mov eax, 0x10044b30
mov byte [0x4705a0], 0xe9
sub eax, 0x4705a5
mov dword [0x4705a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4705a0
call esi
pop esi
pop ecx
ret
Function at 0x10049610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44cfa0
call esi
mov eax, 0x10041df0
mov byte [0x44cfa0], 0xe9
sub eax, 0x44cfa5
mov dword [0x44cfa1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44cfa0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x473904
call esi
mov eax, 0x1004ed20
mov byte [0x473904], 0xe9
sub eax, 0x473909
mov dword [0x473905], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x473904
call esi
call fcn.1004b790
call fcn.1004c9c0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47688c
call esi
mov eax, 0x10045510
mov byte [0x47688c], 0xe9
sub eax, 0x476891
mov dword [0x47688d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47688c
call esi
push 0xffffffffffffffff
mov edx, str.ReloadReserve
mov ecx, str.Misc
call fcn.1000dcb0
mov ecx, dword [0x1013cda8]
test eax, eax
cmovns ecx, eax
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x470c2c
mov dword [0x1013cda8], ecx
call esi
mov eax, 0x100495a0
mov byte [0x470c2c], 0xe9
sub eax, 0x470c31
mov dword [0x470c2d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x470c2c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x46fdf4
call esi
mov eax, 0x100495d0
mov byte [0x46fdf4], 0xe9
sub eax, 0x46fdf9
mov dword [0x46fdf5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x46fdf4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47036c
call esi
mov eax, 0x100495e0
mov byte [0x47036c], 0xe9
sub eax, 0x470371
mov dword [0x47036d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47036c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47304c
call esi
mov eax, 0x100495c0
mov byte [0x47304c], 0xe9
sub eax, 0x473051
mov dword [0x47304d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47304c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x46ec90
call esi
mov eax, 0x100495b0
mov byte [0x46ec90], 0xe9
sub eax, 0x46ec95
mov dword [0x46ec91], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x46ec90
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472b54
call esi
mov eax, 0x100495f0
mov byte [0x472b54], 0xe9
sub eax, 0x472b59
mov dword [0x472b55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472b54
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x476394
call esi
mov eax, 0x10049600
mov byte [0x476394], 0xe9
sub eax, 0x476399
mov dword [0x476395], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x476394
call esi
pop esi
pop ecx
ret
Function at 0x1004b790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10019790
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4454de
call esi
mov eax, 0x100498a0
mov byte [0x4454de], 0xe8
sub eax, 0x4454e3
mov dword [0x4454df], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4454de
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4757f0
call esi
mov eax, 0x1004b780
mov byte [0x4757f0], 0xe9
sub eax, 0x4757f5
mov dword [0x4757f1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4757f0
call esi
pop esi
pop ecx
ret

Function at 0x1004c9c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x471d5c
call esi
mov eax, fcn.1004b810
mov byte [0x471d5c], 0xe9
sub eax, 0x471d61
mov dword [0x471d5d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x471d5c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472d24
call esi
mov eax, 0x1004c9b0
mov byte [0x472d24], 0xe9
sub eax, 0x472d29
mov dword [0x472d25], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472d24
call esi
pop esi
pop ecx
ret
Function at 0x10052150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
sub esp, 0x28
mov ecx, 0x10154dd0
mov eax, esp
mov dword [eax], 0x10122d30
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x100521ab
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4996b4
call esi
mov eax, 0x10052120
mov byte [0x4996b4], 0xe9
sub eax, 0x4996b9
mov dword [0x4996b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4996b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x497bd8
call esi
mov eax, 0x10052130
mov byte [0x497bd8], 0xe9
sub eax, 0x497bdd
mov dword [0x497bd9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x497bd8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x51c170
call esi
lea eax, [esp + 4]
mov dword [0x51c170], 0x10052130
push eax
push dword [esp + 8]
push 4
push 0x51c170
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x51c178
call esi
lea eax, [esp + 4]
mov dword [0x51c178], 0x10052140
push eax
push dword [esp + 8]
push 4
push 0x51c178
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x499530
call esi
mov eax, 0x10052100
mov byte [0x499530], 0xe8
sub eax, 0x499535
mov dword [0x499531], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x499530
call esi
pop esi
add esp, 0x10
ret

Function at 0x100557d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43aaec
call esi
mov eax, 0x100557b0
mov byte [0x43aaec], 0xe9
sub eax, 0x43aaf1
mov dword [0x43aaed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43aaec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43db54
call esi
mov eax, 0x100557c0
mov byte [0x43db54], 0xe9
sub eax, 0x43db59
mov dword [0x43db55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43db54
call esi
pop esi
pop ecx
ret

Function at 0x10056ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x434238
call esi
mov eax, 0x10056b80
mov byte [0x434238], 0xe9
sub eax, 0x43423d
mov dword [0x434239], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x434238
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43bce0
call esi
mov eax, 0x10056b90
mov byte [0x43bce0], 0xe9
sub eax, 0x43bce5
mov dword [0x43bce1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43bce0
call esi
pop esi
pop ecx
ret
Function at 0x1005c020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
call fcn.100557d0
push 0
mov edx, str.DisplayUnusedStat
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
jle 0x1005c057
push 0
mov edx, str.UnusedStatImage
mov ecx, str.Misc
call fcn.1000dcb0
inc dword [0x1013ce98]
mov dword [0x1013ce94], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43527c
call esi
mov eax, 0x1005bff0
mov byte [0x43527c], 0xe9
sub eax, 0x435281
mov dword [0x43527d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43527c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x434b38
call esi
mov eax, 0x1005c000
mov byte [0x434b38], 0xe9
sub eax, 0x434b3d
mov dword [0x434b39], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x434b38
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4365ac
call esi
mov eax, 0x1005c010
mov byte [0x4365ac], 0xe9
sub eax, 0x4365b1
mov dword [0x4365ad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4365ac
call esi
pop esi
pop ecx
ret

Function at 0x1005cc60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447914
call esi
mov eax, 0x1005cc30
mov byte [0x447914], 0xe9
sub eax, 0x447919
mov dword [0x447915], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447914
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x446a18
call esi
mov eax, 0x1005cc40
mov byte [0x446a18], 0xe9
sub eax, 0x446a1d
mov dword [0x446a19], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x446a18
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x446d30
call esi
mov eax, 0x1005cc50
mov byte [0x446d30], 0xe9
sub eax, 0x446d35
mov dword [0x446d31], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x446d30
call esi
pop esi
pop ecx
ret
Function at 0x1005f530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c05c4
call esi
mov eax, 0x1005f4b0
mov byte [0x4c05c4], 0xe9
sub eax, 0x4c05c9
mov dword [0x4c05c5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c05c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c219c
call esi
mov eax, 0x1005f4c0
mov byte [0x4c219c], 0xe9
sub eax, 0x4c21a1
mov dword [0x4c219d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c219c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c2270
call esi
mov eax, 0x1005f4d0
mov byte [0x4c2270], 0xe9
sub eax, 0x4c2275
mov dword [0x4c2271], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c2270
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c50f4
call esi
mov eax, 0x1005f4e0
mov byte [0x4c50f4], 0xe9
sub eax, 0x4c50f9
mov dword [0x4c50f5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c50f4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c41ec
call esi
mov eax, 0x1005f4f0
mov byte [0x4c41ec], 0xe9
sub eax, 0x4c41f1
mov dword [0x4c41ed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c41ec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c3830
call esi
mov eax, 0x1005f500
mov byte [0x4c3830], 0xe9
sub eax, 0x4c3835
mov dword [0x4c3831], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c3830
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c4bd0
call esi
mov eax, 0x1005f510
mov byte [0x4c4bd0], 0xe9
sub eax, 0x4c4bd5
mov dword [0x4c4bd1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c4bd0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c2e44
call esi
mov eax, 0x1005f520
mov byte [0x4c2e44], 0xe9
sub eax, 0x4c2e49
mov dword [0x4c2e45], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c2e44
call esi
pop esi
pop ecx
ret
Function at 0x1006a8f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a908
call esi
mov eax, 0x1006aa60
mov byte [0x47a908], 0xe9
sub eax, 0x47a90d
mov dword [0x47a909], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a908
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e564
call esi
mov eax, 0x1006a8c0
mov byte [0x42e564], 0xe9
sub eax, 0x42e569
mov dword [0x42e565], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e564
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48328c
call esi
mov eax, 0x1006a8d0
mov byte [0x48328c], 0xe9
sub eax, 0x483291
mov dword [0x48328d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48328c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x483c98
call esi
mov eax, 0x1006a8e0
mov byte [0x483c98], 0xe9
sub eax, 0x483c9d
mov dword [0x483c99], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x483c98
call esi
pop esi
pop ecx
ret
Function at 0x1006b100
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b12f8
call esi
mov eax, 0x1006b0f0
mov byte [0x4b12f8], 0xe9
sub eax, 0x4b12fd
mov dword [0x4b12f9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b12f8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b3924
call esi
mov eax, 0x1006b0e0
mov byte [0x4b3924], 0xe9
sub eax, 0x4b3929
mov dword [0x4b3925], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b3924
call esi
pop esi
pop ecx
ret

Function at 0x1006cca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44df40
call esi
mov eax, 0x1006cc50
mov byte [0x44df40], 0xe9
sub eax, 0x44df45
mov dword [0x44df41], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44df40
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44c840
call esi
mov eax, 0x1006cc60
mov byte [0x44c840], 0xe9
sub eax, 0x44c845
mov dword [0x44c841], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44c840
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44b684
call esi
mov eax, 0x1006cc70
mov byte [0x44b684], 0xe9
sub eax, 0x44b689
mov dword [0x44b685], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44b684
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44ca18
call esi
mov eax, 0x1006cc80
mov byte [0x44ca18], 0xe9
sub eax, 0x44ca1d
mov dword [0x44ca19], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44ca18
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44df94
call esi
mov eax, 0x1006cc90
mov byte [0x44df94], 0xe9
sub eax, 0x44df99
mov dword [0x44df95], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44df94
call esi
pop esi
pop ecx
ret
Function at 0x1006f290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a5e34
call esi
mov eax, 0x1006f210
mov byte [0x4a5e34], 0xe9
sub eax, 0x4a5e39
mov dword [0x4a5e35], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a5e34
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a390c
call esi
mov eax, 0x1006f220
mov byte [0x4a390c], 0xe9
sub eax, 0x4a3911
mov dword [0x4a390d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a390c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a39ac
call esi
mov eax, 0x1006f230
mov byte [0x4a39ac], 0xe9
sub eax, 0x4a39b1
mov dword [0x4a39ad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a39ac
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a4f28
call esi
mov eax, 0x1006e9f0
mov byte [0x4a4f28], 0xe9
sub eax, 0x4a4f2d
mov dword [0x4a4f29], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a4f28
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a61d4
call esi
mov eax, 0x1006f240
mov byte [0x4a61d4], 0xe9
sub eax, 0x4a61d9
mov dword [0x4a61d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a61d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a63e0
call esi
mov eax, 0x1006f250
mov byte [0x4a63e0], 0xe9
sub eax, 0x4a63e5
mov dword [0x4a63e1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a63e0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a4810
call esi
mov eax, 0x1006f260
mov byte [0x4a4810], 0xe9
sub eax, 0x4a4815
mov dword [0x4a4811], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a4810
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a67ec
call esi
mov eax, 0x1006f270
mov byte [0x4a67ec], 0xe9
sub eax, 0x4a67f1
mov dword [0x4a67ed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a67ec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a67e4
call esi
mov eax, 0x1006f280
mov byte [0x4a67e4], 0xe9
sub eax, 0x4a67e9
mov dword [0x4a67e5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a67e4
call esi
pop esi
pop ecx
ret