joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100751b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
movaps xmm0, xmmword [0x101329d0]
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4d9808
movups xmmword [0x10142cb8], xmm0
mov dword [0x10142cc8], 0x7feb
mov dword [0x10142ccc], 0x7c00
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100751a0
mov byte [0x4d9808], 0xe9
sub eax, 0x4d980d
mov dword [0x4d9809], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4d9808
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10075ce0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100751b0
call fcn.10076340
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6dac
call esi
mov eax, 0x10075c80
mov byte [0x4d6dac], 0xe9
sub eax, 0x4d6db1
mov dword [0x4d6dad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6dac
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6e64
call esi
mov eax, 0x10075c90
mov byte [0x4d6e64], 0xe9
sub eax, 0x4d6e69
mov dword [0x4d6e65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6e64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6ea0
call esi
mov eax, 0x10075ca0
mov byte [0x4d6ea0], 0xe9
sub eax, 0x4d6ea5
mov dword [0x4d6ea1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6ea0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d765c
call esi
mov eax, 0x10075cb0
mov byte [0x4d765c], 0xe9
sub eax, 0x4d7661
mov dword [0x4d765d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d765c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6238
call esi
mov eax, 0x10075cc0
mov byte [0x4d6238], 0xe9
sub eax, 0x4d623d
mov dword [0x4d6239], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6238
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6468
call esi
mov eax, 0x10075cd0
mov byte [0x4d6468], 0xe9
sub eax, 0x4d646d
mov dword [0x4d6469], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6468
call esi
pop esi
pop ecx
ret
Function at 0x10076340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b6a54
call esi
mov eax, 0x100772f0
mov byte [0x4b6a54], 0xe9
sub eax, 0x4b6a59
mov dword [0x4b6a55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b6a54
call esi
sub esp, 0x28
mov ecx, 0x100762a0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x100763a7
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x100762a0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154dd0
push eax
call fcn.1001d210
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x100763f0
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b7f3c
call esi
mov eax, 0x100762f0
mov byte [0x4b7f3c], 0xe9
sub eax, 0x4b7f41
mov dword [0x4b7f3d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b7f3c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b78a4
call esi
mov eax, 0x10076300
mov byte [0x4b78a4], 0xe9
sub eax, 0x4b78a9
mov dword [0x4b78a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b78a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b81c4
call esi
mov eax, 0x10076310
mov byte [0x4b81c4], 0xe9
sub eax, 0x4b81c9
mov dword [0x4b81c5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b81c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b8330
call esi
mov eax, 0x10076320
mov byte [0x4b8330], 0xe9
sub eax, 0x4b8335
mov dword [0x4b8331], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b8330
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b83d4
call esi
mov eax, 0x10076330
mov byte [0x4b83d4], 0xe9
sub eax, 0x4b83d9
mov dword [0x4b83d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b83d4
call esi
pop esi
add esp, 0x10
ret

Function at 0x100767f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d78cc
call esi
mov eax, 0x10076750
mov byte [0x4d78cc], 0xe9
sub eax, 0x4d78d1
mov dword [0x4d78cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d78cc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d797c
call esi
mov eax, 0x100767d0
mov byte [0x4d797c], 0xe9
sub eax, 0x4d7981
mov dword [0x4d797d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d797c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d650c
call esi
mov eax, 0x100767e0
mov byte [0x4d650c], 0xe9
sub eax, 0x4d6511
mov dword [0x4d650d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d650c
call esi
pop esi
pop ecx
ret
Function at 0x10078680
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100798d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c1a64
call esi
mov eax, 0x10077e70
mov byte [0x4c1a64], 0xe9
sub eax, 0x4c1a69
mov dword [0x4c1a65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c1a64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4bfb08
call esi
mov eax, 0x10078650
mov byte [0x4bfb08], 0xe9
sub eax, 0x4bfb0d
mov dword [0x4bfb09], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4bfb08
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c59a4
call esi
mov eax, 0x10078660
mov byte [0x4c59a4], 0xe9
sub eax, 0x4c59a9
mov dword [0x4c59a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c59a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c4634
call esi
mov eax, 0x10078670
mov byte [0x4c4634], 0xe9
sub eax, 0x4c4639
mov dword [0x4c4635], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c4634
call esi
pop esi
pop ecx
ret
Function at 0x100798d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
call fcn.1005f4f0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.TownMapHotkeys
mov edx, str.Debugging
mov ecx, str..ddraw.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x10079948
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1007997a
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
jmp 0x1007997a
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10079976
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
test esi, esi
jne 0x100799cc
cmp byte [0x10174f84], 0
je 0x100799c5
test byte [0x10174f88], 0x10
je 0x100799c5
mov edx, str.Applying_town_map_hotkeys_fix_patch.
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x100799c5
mov edx, str.Applying_town_map_hotkeys_fix_patch.
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
mov byte [0x1017503d], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4c1e54
call esi
mov eax, 0x100798b0
mov byte [0x4c1e54], 0xe9
sub eax, 0x4c1e59
mov dword [0x4c1e55], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x4c1e54
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4bfe10
call esi
mov eax, 0x100798c0
mov byte [0x4bfe10], 0xe9
sub eax, 0x4bfe15
mov dword [0x4bfe11], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x4bfe10
call esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10079b60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0x436c8e
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x437045
push eax
push ecx
mov ecx, 0x10079a50
mov dword [esp + 0x20], 0x43769b
mov dword [esp + 0x24], 0x43800a
mov dword [esp + 0x28], 0x41e027
mov dword [esp + 0x2c], 0x41ec22
call fcn.100122b0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x41d105
call esi
mov eax, 0x10079ac0
sub eax, 0x41d109
mov dword [0x41d105], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x41d105
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x43ae93
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x43af59
push eax
push ecx
mov ecx, 0x10079ad0
call fcn.100122b0
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43cb5d
call esi
mov eax, 0x10079b50
sub eax, 0x43cb61
mov dword [0x43cb5d], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43cb5d
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007ac60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, ecx
push edi
mov edi, edx
xor ebx, ebx
sub ebp, edi
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x10]
cmova ebp, ecx
test ebp, ebp
je 0x1007acb4
push esi
mov esi, dword [edi]
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
mov dword [esi], 0x1013cef8
push eax
push dword [esp + 0x18]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x1007ac81
pop esi
pop edi
pop ebp
pop ebx
ret 4

Function at 0x1007aec0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fb3
call esi
mov eax, 0x1007acc0
sub eax, 0x443fb7
mov dword [0x443fb3], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x443fb3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44401e
call esi
mov eax, 0x1007ad60
sub eax, 0x444022
mov dword [0x44401e], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44401e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x444078
call esi
mov eax, 0x1007aeb0
sub eax, 0x44407c
mov dword [0x444078], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x444078
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
mov dword [0x443fef], 0xfffd516d
push eax
push dword [esp + 8]
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x443fec
call esi
mov eax, 0xca89
mov word [0x443fec], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x443fec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x444039
call esi
mov dword [0x444039], 0x441f0f
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x444039
call esi
pop esi
pop ecx
ret
Function at 0x1007b200
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40
mov dword [esp], ecx
push ebx
push ebp
mov ebp, edx
mov edx, ecx
push esi
push edi
test cl, 3
je 0x1007b219
and edx, 0xfffffffc
add edx, 4
mov edi, dword [esp + 0x5c]
mov eax, edx
sub eax, ecx
imul edx, ebp
mov dword [esp + 0x14], eax
mov eax, 0x4d42
mov word [esp + 0x18], ax
push edi
push 1
push 0xe
mov dword [esp + 0x2e], 0x436
mov dword [esp + 0x34], 0x28
lea eax, [edx + 0x436]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x26], eax
xor eax, eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], 0x80001
mov dword [esp + 0x4c], edx
mov dword [esp + 0x58], 0x100
call fcn.100f5fe9
push edi
push 1
lea eax, [esp + 0x40]
push 0x28
push eax
call fcn.100f5fe9
mov esi, dword [esp + 0x78]
add esp, 0x20
add esi, 2
mov ebx, 0x100
nop dword [eax + eax]
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
push edi
shl ecx, 8
or ecx, eax
lea eax, [esp + 0x60]
push 1
shl ecx, 2
push 4
push eax
mov dword [esp + 0x6c], ecx
call fcn.100f5e70
add esp, 0x10
lea esi, [esi + 3]
sub ebx, 1
jne 0x1007b2b0
mov eax, dword [esp + 0x10]
lea ebx, [ebp - 1]
imul ebx, eax
add ebx, dword [esp + 0x54]
test ebp, ebp
jle 0x1007b32a
push edi
push eax
push 1
push ebx
dec ebp
call fcn.100f5e70
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
je 0x1007b320
mov esi, eax
push edi
push 0
call fcn.100ef575
add esp, 8
sub esi, 1
jne 0x1007b310
mov eax, dword [esp + 0x10]
sub ebx, eax
test ebp, ebp
jg 0x1007b2f8
push edi
call fcn.100f22af
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
Function at 0x1007b7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push edi
push 9
mov ebx, edx
mov edi, ecx
push 0
push str.__restart
mov ecx, ebx
call fcn.10007920
cmp eax, 0xffffffff
je 0x1007b7f6
push 1
mov edx, edi
lea ecx, [esp + 0xc]
call fcn.1007b3f0
mov edx, dword [esp + 0x1c]
cmp edx, 0x10
jb 0x1007b7f6
mov ecx, dword [esp + 8]
inc edx
push 1
call fcn.1000d8e0
cmp dword [0x4e4480], 0x278805c7
je 0x1007b877
push str.f2_res.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1007b877
cmp byte [0x10174f82], 0
mov ecx, str.The_enabled_High_Resolution_Patch_by_Mash_is_no_longer_supported__it_will_be_automatically_disabled__n_nNote:_sfall_has_its_own_High_Resolution_patch__which_is_compatible_with_Mash_High_Resolution_Patch.
push 0x2030
push str.SFALL:_High_Resolution_patch
mov eax, 0x101248b0
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
call fcn.1007b520
test al, al
jne 0x1007b86f
cmp byte [0x10174f82], 0
mov ecx, str.Failed_to_disable_the_High_Resolution_Patch_by_Mash._nDo_it_manually_or_delete_the_file_f2_res.dll_from_the_game_folder.
push 0x2010
push str.Error_disable_HRP_by_Mash
mov eax, 0x10124a70
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007cc70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x1013cd3c]
push esi
cmp dword [eax], 0xffffffff
je 0x1001c612
cmp dword [0x518f14], 0
jne 0x1001c612
mov ecx, dword [0x519024]
call fcn.100754e0
mov esi, dword [0x10175044]
test esi, esi
je 0x1001c608
mov ecx, dword [esi]
call fcn.100754e0
mov ecx, dword [esi + 4]
call fcn.100754e0
mov dword [0x518f14], 1
pop esi
jmp fcn.10044110
cmp dword [0x10143a5c], 0
push esi
je 0x1007ccae
mov dl, byte [0x10155921]
test dl, dl
jne 0x1007cc8d
cmp dword [0x518f14], 0
jne 0x1007ccae
lea eax, [ecx - 0x10]
cmp eax, 2
ja 0x1007ccdc
test dl, dl
jne 0x1007ccae
mov esi, dword [0x1015eec4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
jne 0x1007ccb0
mov dword [0x1015eec4], eax
pop esi
ret
mov edx, eax
mov ecx, eax
sub edx, esi
sub ecx, esi
cmp eax, esi
cmovae ecx, edx
cmp ecx, 0xfa
jbe 0x1007ccae
mov dword [0x1015eec4], 0
mov byte [0x10155921], 1
pop esi
jmp 0x1001c5d0
pop esi
jmp fcn.1007ccf0
Function at 0x1007d430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47d52a
call esi
mov eax, 0x1007d3a0
sub eax, 0x47d52e
mov dword [0x47d52a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47d52a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47ed8d
call esi
mov eax, 0x1007d3b0
sub eax, 0x47ed91
mov dword [0x47ed8d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47ed8d
call esi
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x47cc0f
lea ecx, [esp + 4]
mov dword [esp + 8], 0x47be3d
push eax
push ecx
mov ecx, 0x1007d3d0
call fcn.100122b0
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47c628
call esi
mov eax, 0x1007d3f0
sub eax, 0x47c62c
mov dword [0x47c628], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47c628
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47d430
call esi
mov eax, 0x1007d410
sub eax, 0x47d434
mov dword [0x47d430], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47d430
call esi
pop esi
add esp, 8
ret

Function at 0x1007de00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 8], 0x41b979
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x43f560
push eax
push ecx
mov ecx, 0x1007ddd0
mov dword [esp + 0x18], 0x490005
mov dword [esp + 0x1c], 0x490961
call fcn.100122b0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x490eac
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x491546
push eax
push ecx
mov ecx, 0x1007dde0
call fcn.100122b0
mov esi, dword [0x1013cf00]
lea eax, [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x49042a
call edi
lea eax, [esp + 8]
mov dword [0x49042a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x49042a
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x490436
call edi
lea eax, [esp + 8]
mov dword [0x490436], esi
push eax
push dword [esp + 0xc]
push 4
push 0x490436
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x49075f
call edi
lea eax, [esp + 8]
mov dword [0x49075f], esi
push eax
push dword [esp + 0xc]
push 4
push 0x49075f
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007e460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10143a74]
sub esp, 8
test eax, eax
jns 0x1007e478
mov dword [0x10143a74], 0
jmp 0x1007e487
mov ecx, 2
cmp eax, ecx
cmovg eax, ecx
mov dword [0x10143a74], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44e7e4
call edi
mov eax, 0x1007e300
sub eax, 0x44e7e8
mov dword [0x44e7e4], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44e7e4
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44ea76
call edi
mov eax, 0x1007e3e0
sub eax, 0x44ea7a
mov dword [0x44ea76], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44ea76
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
mov dword [0x4877d0], 0x1007e0a0
push eax
push dword [esp + 0xc]
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487813
call edi
lea eax, [esp + 8]
mov dword [0x487813], 0x1007e140
push eax
push dword [esp + 0xc]
push 4
push 0x487813
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4f5d40
call edi
mov eax, 0x1007e090
mov byte [0x4f5d40], 0xe8
sub eax, 0x4f5d45
mov dword [0x4f5d41], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4f5d40
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x48738f
call edi
mov eax, fcn.1007b340
sub eax, 0x487393
mov dword [0x48738f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x48738f
call edi
mov esi, dword [0x1013cf00]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487580
call edi
lea eax, [esp + 8]
mov dword [0x487580], esi
push eax
push dword [esp + 0xc]
push 4
push 0x487580
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4875bf
call edi
mov eax, 0x1007e2a0
sub eax, 0x4875c3
mov dword [0x4875bf], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4875bf
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
mov byte [0x4875c5], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x44e6b2
call edi
mov eax, 0x1007e2b0
mov byte [0x44e6b2], 0xe8
sub eax, 0x44e6b7
mov dword [0x44e6b3], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x44e6b2
call edi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x44eac9
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x44eadd
push eax
push ecx
mov ecx, 0x1007e2d0
call fcn.10012330
pop edi
pop esi
add esp, 8
ret
Function at 0x100837a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fa1e
call edi
mov eax, 0x10083700
sub eax, 0x43fa22
mov dword [0x43fa1e], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fa1e
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43f805
call edi
mov eax, 0x10083790
sub eax, 0x43f809
mov dword [0x43f805], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43f805
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
mov dword [0x44065a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440024
call edi
mov eax, 0x100831a0
sub eax, 0x440028
mov dword [0x440024], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x440024
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44004f
call edi
mov eax, fcn.100831d0
sub eax, 0x440053
mov dword [0x44004f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44004f
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44012a
call edi
mov eax, 0x100833b0
sub eax, 0x44012e
mov dword [0x44012a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44012a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44063a
call edi
mov eax, 0x100834f0
sub eax, 0x44063e
mov dword [0x44063a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44063a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fde4
call edi
mov eax, 0x10083580
sub eax, 0x43fde8
mov dword [0x43fde4], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fde4
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc81
call edi
mov eax, 0x10083520
sub eax, 0x43fc85
mov dword [0x43fc81], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fc81
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
mov byte [0x43fc75], 0x56
push eax
push dword [esp + 0xc]
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440072
call edi
lea eax, [esp + 8]
mov dword [0x440072], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x440072
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc94
call edi
lea eax, [esp + 8]
mov dword [0x43fc94], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x43fc94
call edi
pop edi
pop esi
pop ecx
ret

Function at 0x10083f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 4
push 0x442b0c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10083f20
sub eax, 0x442b10
mov dword [0x442b0c], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x442b0c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret