joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f0b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4716e8
call esi
mov eax, 0x1001f010
mov byte [0x4716e8], 0xe9
sub eax, 0x4716ed
mov dword [0x4716e9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4716e8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x477490
call esi
mov eax, 0x1001e5f0
mov byte [0x477490], 0xe9
sub eax, 0x477495
mov dword [0x477491], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x477490
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x477e98
call esi
mov eax, 0x1001f020
mov byte [0x477e98], 0xe9
sub eax, 0x477e9d
mov dword [0x477e99], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x477e98
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x479a20
call esi
mov eax, 0x1001f030
mov byte [0x479a20], 0xe9
sub eax, 0x479a25
mov dword [0x479a21], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x479a20
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x477b88
call esi
mov eax, 0x1001f040
mov byte [0x477b88], 0xe9
sub eax, 0x477b8d
mov dword [0x477b89], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x477b88
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4772b8
call esi
mov eax, 0x1001f050
mov byte [0x4772b8], 0xe9
sub eax, 0x4772bd
mov dword [0x4772b9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4772b8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478154
call esi
mov eax, 0x1001f060
mov byte [0x478154], 0xe9
sub eax, 0x478159
mov dword [0x478155], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478154
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4779f0
call esi
mov eax, 0x1001f070
mov byte [0x4779f0], 0xe9
sub eax, 0x4779f5
mov dword [0x4779f1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4779f0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49b8b0
call esi
mov eax, 0x1001f000
mov byte [0x49b8b0], 0xe9
sub eax, 0x49b8b5
mov dword [0x49b8b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49b8b0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49b650
call esi
mov eax, 0x1001f080
mov byte [0x49b650], 0xe9
sub eax, 0x49b655
mov dword [0x49b651], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49b650
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49b73c
call esi
mov eax, 0x1001f090
mov byte [0x49b73c], 0xe9
sub eax, 0x49b741
mov dword [0x49b73d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49b73c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472758
call esi
mov eax, 0x1001f0a0
mov byte [0x472758], 0xe9
sub eax, 0x47275d
mov dword [0x472759], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472758
call esi
pop esi
pop ecx
ret
Function at 0x100207a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10020620
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x479898
call esi
mov eax, 0x100205a0
mov byte [0x479898], 0xe9
sub eax, 0x47989d
mov dword [0x479899], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x479898
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478040
call esi
mov eax, 0x100205b0
mov byte [0x478040], 0xe9
sub eax, 0x478045
mov dword [0x478041], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478040
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478b24
call esi
mov eax, 0x100205c0
mov byte [0x478b24], 0xe9
sub eax, 0x478b29
mov dword [0x478b25], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478b24
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478e5c
call esi
mov eax, 0x100205d0
mov byte [0x478e5c], 0xe9
sub eax, 0x478e61
mov dword [0x478e5d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478e5c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4786a0
call esi
mov eax, 0x100205e0
mov byte [0x4786a0], 0xe9
sub eax, 0x4786a5
mov dword [0x4786a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4786a0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478714
call esi
mov eax, 0x100205f0
mov byte [0x478714], 0xe9
sub eax, 0x478719
mov dword [0x478715], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478714
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478a1c
call esi
mov eax, 0x10020600
mov byte [0x478a1c], 0xe9
sub eax, 0x478a21
mov dword [0x478a1d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478a1c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47910c
call esi
mov eax, 0x10020610
mov byte [0x47910c], 0xe9
sub eax, 0x479111
mov dword [0x47910d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47910c
call esi
pop esi
pop ecx
ret

Function at 0x10021370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x488cd5
call esi
mov eax, 0x10020ef0
sub eax, 0x488cd9
mov dword [0x488cd5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x488cd5
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x488cd3
call esi
lea eax, [esp + 4]
mov byte [0x488cd3], 0xf1
push eax
push dword [esp + 8]
push 1
push 0x488cd3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48ac90
call esi
mov eax, 0x10021360
mov byte [0x48ac90], 0xe9
sub eax, 0x48ac95
mov dword [0x48ac91], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48ac90
call esi
pop esi
pop ecx
ret
Function at 0x100216f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x67], 1
je 0x1002171f
push str._nERROR:_Perk_adding_effect_was_called_on_non_critter_
call fcn.10016d10
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
js 0x10021714
cmp edi, 0x77
jl 0x10021740
push 1
call fcn.100bdd30
mov ebp, eax
test ebp, ebp
jne 0x10021749
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
imul ebp, edi, 0x4c
add ebp, 0x1016ec90
mov ebx, dword [ebp + 0x14]
cmp ebx, 0xffffffff
je 0x10021769
mov edx, ebx
mov ecx, esi
call fcn.100242c0
mov ecx, dword [ebp + 0x18]
mov edx, ebx
add ecx, eax
push ecx
mov ecx, esi
call fcn.10024470
cmp edi, 0x5c
jne 0x100217bb
mov edi, dword [0x6681b0]
inc edi
cmp edi, dword [0x51d8f4]
jge 0x100217e1
mov ecx, esi
call fcn.10021430
mov ebx, eax
mov ecx, edi
dec dword [ebx + 0x170]
call fcn.100c6590
cmp eax, 0xfffffffe
jne 0x1002179f
mov ecx, edi
call fcn.100223c0
sub eax, dword [0x6681b4]
xor edx, edx
mov ecx, eax
mov dword [0x51c124], eax
call fcn.10022580
inc dword [ebx + 0x170]
jmp 0x100217e1
cmp edi, 0x54
jl 0x100217e1
cmp edi, 0x5a
jg 0x100217e1
mov ecx, dword [esi + 0x64]
lea edx, [esp + 0x14]
call fcn.1003bde0
cmp eax, 0xffffffff
je 0x100217e1
mov eax, dword [esp + 0x14]
inc dword [eax + edi*4 - 0x12c]
cmp dword [ebp + 0xc], 0xffffffff
jne 0x1002183b
xor ebx, ebx
mov edi, 0xb0
nop
xor ecx, ecx
cmp ebx, 0x22
ja 0x1002181f
cmp byte [esi + 0x67], 1
jne 0x1002181f
mov ecx, esi
call fcn.10088050
mov dword [esp + 0x14], eax
test eax, eax
jne 0x1002181c
mov ecx, dword [esi + 0x64]
lea edx, [esp + 0x14]
call fcn.1003bde0
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + eax]
mov eax, dword [edi + ebp - 0x80]
mov edx, ebx
add eax, ecx
mov ecx, esi
push eax
call fcn.10024470
add edi, 4
inc ebx
cmp edi, 0xcc
jl 0x100217f0
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021850
Capabilities:
Check for software breakpoints

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x67], 1
je 0x10021872
push str._nERROR:_Perk_remove_effect_was_called_on_non_critter_
call fcn.10016d10
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test edi, edi
js 0x10021929
cmp edi, 0x77
jl 0x10021892
push 0
call fcn.100bdd30
mov ebp, eax
test ebp, ebp
je 0x10021929
jmp 0x1002189b
imul ebp, edi, 0x4c
add ebp, 0x1016ec90
mov ebx, dword [ebp + 0x14]
cmp ebx, 0xffffffff
je 0x100218b9
mov edx, ebx
mov ecx, esi
call fcn.100242c0
sub eax, dword [ebp + 0x18]
mov edx, ebx
push eax
mov ecx, esi
call fcn.10024470
cmp edi, 0x5c
jne 0x100218d2
mov edx, dword [0x6681b4]
lea ecx, [edi - 0x5a]
sub edx, dword [0x51c124]
call fcn.10022340
cmp dword [ebp + 0xc], 0xffffffff
jne 0x10021929
xor ebx, ebx
mov edi, 0xb0
nop
xor eax, eax
cmp ebx, 0x22
ja 0x1002190f
cmp byte [esi + 0x67], 1
jne 0x1002190f
mov ecx, esi
call fcn.10088050
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1002190c
mov ecx, dword [esi + 0x64]
lea edx, [esp + 0x10]
call fcn.1003bde0
mov eax, dword [esp + 0x10]
mov eax, dword [edi + eax]
sub eax, dword [edi + ebp - 0x80]
mov edx, ebx
push eax
mov ecx, esi
call fcn.10024470
add edi, 4
inc ebx
cmp edi, 0xcc
jl 0x100218e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10021b80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49678c
call esi
mov eax, 0x10021b30
mov byte [0x49678c], 0xe9
sub eax, 0x496791
mov dword [0x49678d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49678c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49680c
call esi
mov eax, 0x10021b40
mov byte [0x49680c], 0xe9
sub eax, 0x496811
mov dword [0x49680d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49680c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x496bfc
call esi
mov eax, 0x10021b50
mov byte [0x496bfc], 0xe9
sub eax, 0x496c01
mov dword [0x496bfd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x496bfc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x496ce0
call esi
mov eax, 0x10021b60
mov byte [0x496ce0], 0xe9
sub eax, 0x496ce5
mov dword [0x496ce1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x496ce0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x496b78
call esi
mov eax, 0x10021b70
mov byte [0x496b78], 0xe9
sub eax, 0x496b7d
mov dword [0x496b79], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x496b78
call esi
pop esi
pop ecx
ret
Function at 0x10022a80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af9a0
call esi
mov eax, 0x10022a30
mov byte [0x4af9a0], 0xe9
sub eax, 0x4af9a5
mov dword [0x4af9a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af9a0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4221b4
call esi
mov eax, 0x10022a40
mov byte [0x4221b4], 0xe9
sub eax, 0x4221b9
mov dword [0x4221b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4221b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4afab8
call esi
mov eax, 0x10022a50
mov byte [0x4afab8], 0xe9
sub eax, 0x4afabd
mov dword [0x4afab9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4afab8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4afc38
call esi
mov eax, 0x10022a60
mov byte [0x4afc38], 0xe9
sub eax, 0x4afc3d
mov dword [0x4afc39], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4afc38
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e220
call esi
mov eax, 0x10022a70
mov byte [0x42e220], 0xe9
sub eax, 0x42e225
mov dword [0x42e221], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e220
call esi
pop esi
pop ecx
ret

Function at 0x10022bb0
Capabilities:
Terminate process

Disassembly:
push ecx
push str._nError:_Cant_find__d_msg_num_in_proto.msg_
call fcn.10016d10
add esp, 8
push 1
call fcn.100f668f
int3

Function at 0x10023a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49ad88
call esi
mov eax, 0x100239f0
mov byte [0x49ad88], 0xe9
sub eax, 0x49ad8d
mov dword [0x49ad89], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49ad88
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49ad78
call esi
mov eax, 0x10023a00
mov byte [0x49ad78], 0xe9
sub eax, 0x49ad7d
mov dword [0x49ad79], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49ad78
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49eafc
call esi
mov eax, 0x10023a10
mov byte [0x49eafc], 0xe9
sub eax, 0x49eb01
mov dword [0x49eafd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49eafc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49f8a0
call esi
mov eax, 0x10023a20
mov byte [0x49f8a0], 0xe9
sub eax, 0x49f8a5
mov dword [0x49f8a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49f8a0
call esi
pop esi
pop ecx
ret
Function at 0x10024120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4aa558
call esi
mov eax, 0x10024100
mov byte [0x4aa558], 0xe9
sub eax, 0x4aa55d
mov dword [0x4aa559], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4aa558
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4aaaa4
call esi
mov eax, 0x10024110
mov byte [0x4aaaa4], 0xe9
sub eax, 0x4aaaa9
mov dword [0x4aaaa5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4aaaa4
call esi
pop esi
pop ecx
ret

Function at 0x10024f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.1001b810
call fcn.10022a80
call fcn.10021b80
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af408
call esi
mov eax, 0x10024f00
mov byte [0x4af408], 0xe9
sub eax, 0x4af40d
mov dword [0x4af409], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af408
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af3e0
call esi
mov eax, 0x10024f10
mov byte [0x4af3e0], 0xe9
sub eax, 0x4af3e5
mov dword [0x4af3e1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af3e0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af474
call esi
mov eax, 0x10024f20
mov byte [0x4af474], 0xe9
sub eax, 0x4af479
mov dword [0x4af475], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af474
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af4bc
call esi
mov eax, 0x10024f30
mov byte [0x4af4bc], 0xe9
sub eax, 0x4af4c1
mov dword [0x4af4bd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af4bc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af63c
call esi
mov eax, 0x10024f40
mov byte [0x4af63c], 0xe9
sub eax, 0x4af641
mov dword [0x4af63d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af63c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4aef48
call esi
mov eax, 0x10024f50
mov byte [0x4aef48], 0xe9
sub eax, 0x4aef4d
mov dword [0x4aef49], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4aef48
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b3c7c
call esi
mov eax, 0x10024f60
mov byte [0x4b3c7c], 0xe9
sub eax, 0x4b3c81
mov dword [0x4b3c7d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b3c7c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af6fc
call esi
mov eax, 0x10024f70
mov byte [0x4af6fc], 0xe9
sub eax, 0x4af701
mov dword [0x4af6fd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af6fc
call esi
push 0
mov edx, str.SmallFrameFix
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
pop esi
setg byte [0x10174fad]
pop ecx
ret
Function at 0x10026ee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
movzx eax, byte [0x4abc4f]
push esi
mov dword [0x1013cd70], eax
call fcn.1001c450
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49bf38
call esi
mov eax, 0x10026ea0
mov byte [0x49bf38], 0xe9
sub eax, 0x49bf3d
mov dword [0x49bf39], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49bf38
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49c124
call esi
mov eax, 0x10026eb0
mov byte [0x49c124], 0xe9
sub eax, 0x49c129
mov dword [0x49c125], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49c124
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49c5fc
call esi
mov eax, 0x10026ec0
mov byte [0x49c5fc], 0xe9
sub eax, 0x49c601
mov dword [0x49c5fd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49c5fc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49bba8
call esi
mov eax, 0x10026ed0
mov byte [0x49bba8], 0xe9
sub eax, 0x49bbad
mov dword [0x49bba9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49bba8
call esi
pop esi
pop ecx
ret

Function at 0x10029bc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.1002b6b0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x429db4
call esi
mov eax, 0x10029ba0
mov byte [0x429db4], 0xe9
sub eax, 0x429db9
mov dword [0x429db5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x429db4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42a7d8
call esi
mov eax, 0x10029bb0
mov byte [0x42a7d8], 0xe9
sub eax, 0x42a7dd
mov dword [0x42a7d9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42a7d8
call esi
pop esi
pop ecx
ret
Function at 0x1002a510
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.1002ad20
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x428480
call esi
mov eax, 0x1002a4d0
mov byte [0x428480], 0xe9
sub eax, 0x428485
mov dword [0x428481], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x428480
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4298ec
call esi
mov eax, 0x1002a4f0
mov byte [0x4298ec], 0xe9
sub eax, 0x4298f1
mov dword [0x4298ed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4298ec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42aecc
call esi
mov eax, 0x1002a500
mov byte [0x42aecc], 0xe9
sub eax, 0x42aed1
mov dword [0x42aecd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42aecc
call esi
push 6
push 0x1002a4e0
mov edx, 0x429bde
mov cl, 0xe8
call fcn.100120f0
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x429be9
call esi
lea eax, [esp + 4]
mov byte [0x429be9], 0x75
push eax
push dword [esp + 8]
push 1
push 0x429be9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x429bf1
call esi
lea eax, [esp + 4]
mov byte [0x429bf1], 0xeb
push eax
push dword [esp + 8]
push 1
push 0x429bf1
call esi
push 0
mov edx, str.AIDrugUsePerfFix
mov ecx, str.Misc
call fcn.1000dcb0
mov dword [0x10155850], eax
test eax, eax
jle 0x1002a68f
cmp byte [0x10174f84], 0
je 0x1002a68f
test byte [0x10174f88], 0x10
je 0x1002a68f
mov edx, str.Applying_AI_drug_use_preference_fix.
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x1002a68f
mov edx, str.Applying_AI_drug_use_preference_fix.
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42a467
call esi
lea eax, [esp + 4]
mov dword [0x42a467], 0x10121cb0
push eax
push dword [esp + 8]
push 4
push 0x42a467
call esi
pop esi
pop ecx
ret

Function at 0x1002ad20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x428f4c
call esi
mov eax, 0x1002ad00
mov byte [0x428f4c], 0xe9
sub eax, 0x428f51
mov dword [0x428f4d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x428f4c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x428cf4
call esi
mov eax, 0x1002ad10
mov byte [0x428cf4], 0xe9
sub eax, 0x428cf9
mov dword [0x428cf5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x428cf4
call esi
pop esi
pop ecx
ret
Function at 0x1002b6b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4299a0
call esi
mov eax, 0x1002b680
mov byte [0x4299a0], 0xe9
sub eax, 0x4299a5
mov dword [0x4299a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4299a0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x429a6c
call esi
mov eax, 0x1002b690
mov byte [0x429a6c], 0xe9
sub eax, 0x429a71
mov dword [0x429a6d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x429a6c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x429d60
call esi
mov eax, 0x1002b6a0
mov byte [0x429d60], 0xe9
sub eax, 0x429d65
mov dword [0x429d61], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x429d60
call esi
pop esi
pop ecx
ret

Function at 0x1002c020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x429fc8
call esi
mov eax, 0x1002bff0
mov byte [0x429fc8], 0xe9
sub eax, 0x429fcd
mov dword [0x429fc9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x429fc8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42899c
call esi
mov eax, 0x1002c000
mov byte [0x42899c], 0xe9
sub eax, 0x4289a1
mov dword [0x42899d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42899c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x428868
call esi
mov eax, 0x1002c010
mov byte [0x428868], 0xe9
sub eax, 0x42886d
mov dword [0x428869], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x428868
call esi
pop esi
pop ecx
ret