joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
push 0x4c
call fcn.100ea165
add esp, 4
test eax, eax
je 0x1003c087
push 0x10007540
push 0x1003c1e0
push 6
lea esi, [eax + 4]
mov dword [eax], 6
push 0xc
push esi
call fcn.100ea263
mov dword [0x1015586c], esi
jmp 0x1003c091
mov dword [0x1015586c], 0
sub esp, 0x28
mov ecx, 0x1003bc40
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x1003c0b6
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x1003bc40
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154db8
push eax
call fcn.1001d210
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1003c0ff
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2108
call esi
mov eax, 0x1003c030
mov byte [0x4a2108], 0xe9
sub eax, 0x4a210d
mov dword [0x4a2109], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2108
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2094
call esi
mov eax, 0x1003c040
mov byte [0x4a2094], 0xe9
sub eax, 0x4a2099
mov dword [0x4a2095], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2094
call esi
pop esi
add esp, 0x10
ret

Function at 0x1003cc60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a281c
call esi
mov eax, 0x1003cc20
mov byte [0x4a281c], 0xe9
sub eax, 0x4a2821
mov dword [0x4a281d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a281c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a258c
call esi
mov eax, 0x1003cc30
mov byte [0x4a258c], 0xe9
sub eax, 0x4a2591
mov dword [0x4a258d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a258c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2790
call esi
mov eax, 0x1003cc40
mov byte [0x4a2790], 0xe9
sub eax, 0x4a2795
mov dword [0x4a2791], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2790
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a26d0
call esi
mov eax, 0x1003cc50
mov byte [0x4a26d0], 0xe9
sub eax, 0x4a26d5
mov dword [0x4a26d1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a26d0
call esi
pop esi
pop ecx
ret
Function at 0x1003cfc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c8f4c
call esi
mov eax, 0x1003cfa0
mov byte [0x4c8f4c], 0xe9
sub eax, 0x4c8f51
mov dword [0x4c8f4d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c8f4c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443ef4
call esi
mov eax, 0x1003cf20
sub eax, 0x443ef8
mov dword [0x443ef4], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x443ef4
call esi
pop esi
pop ecx
ret

Function at 0x1003d040
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 0x21
push 0x101558d0
push 0x10122374
mov edx, str.ScreenShot
mov ecx, 0x1011f8fc
call fcn.1000dde0
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4c9048
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1003cfb0
mov byte [0x4c9048], 0xe9
sub eax, 0x4c904d
mov dword [0x4c9049], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4c9048
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x1003dcc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447614
call esi
mov eax, 0x1003dfa0
mov byte [0x447614], 0xe9
sub eax, 0x447619
mov dword [0x447615], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447614
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4458bc
call esi
mov eax, 0x1003dcb0
mov byte [0x4458bc], 0xe9
sub eax, 0x4458c1
mov dword [0x4458bd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4458bc
call esi
pop esi
pop ecx
ret

Function at 0x1003dda0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5186fc]
push ebx
push esi
push edi
test eax, eax
je 0x1003ddb6
movzx edi, word [eax + 8]
jmp 0x1003ddb9
or edi, 0xffffffff
mov eax, dword [0x1013cc58]
cmp edi, dword [eax]
jle 0x1003de34
push str._n_Waiting_for_fidget_to_complete...
call fcn.10016d10
mov eax, dword [0x1013cc58]
add esp, 4
cmp edi, dword [eax]
jle 0x1003de34
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
call fcn.1003b910
mov eax, dword [0x1013cc5c]
mov esi, dword [eax]
call ebx
mov edx, eax
mov ecx, eax
sub edx, esi
sub ecx, esi
cmp eax, esi
mov eax, 0x596c34
cmovae ecx, edx
cmp ecx, dword [eax]
jb 0x1003de2b
mov edx, dword [0x1013cc58]
mov eax, 0x5186fc
mov edx, dword [edx]
mov ecx, dword [eax]
call fcn.1005c100
call ebx
mov ecx, dword [0x1013cc5c]
mov dword [ecx], eax
mov eax, dword [0x1013cc58]
inc dword [eax]
jmp 0x1003de30
mov eax, dword [0x1013cc58]
cmp edi, dword [eax]
jg 0x1003dde0
mov dword [eax], 0
mov eax, dword [0x5186f8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call dword [0x10120e98]
cmp eax, 0xffffffff
jne 0x1003de5d
push str._n_Error_unlocking_fidget_on_transition...
call fcn.10016d10
add esp, 4
pop edi
pop esi
mov dword [0x5186fc], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003de70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5186fc], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0xc], ebx
je 0x1003df92
cmp dword [0x518744], 0xffffffff
je 0x1003df92
call dword [0x10121424]
push str._nStarting_transition...
call fcn.10016d10
add esp, 4
call fcn.1003dda0
mov eax, dword [0x518850]
movzx ecx, bl
and eax, 0xfff
or ecx, 0x800
shl ecx, 0x10
or ecx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call dword [0x10120ea0]
mov ebx, eax
test ebx, ebx
jne 0x1003def7
push str._n_Error_locking_transition...
call fcn.10016d10
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov dword [0x1016eaf8], eax
movzx eax, word [ebx + 4]
movsx ecx, ax
test ax, ax
jne 0x1003df10
mov ecx, 0xa
mov eax, 0x2ee
xor edi, edi
cdq
xor esi, esi
idiv ecx
mov dword [ebp - 0xc], eax
movzx eax, word [ebx + 8]
mov dword [ebp - 8], eax
test eax, eax
jle 0x1003df64
nop word [eax + eax]
call fcn.1003b910
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov ecx, eax
sub edx, edi
sub ecx, edi
cmp eax, edi
cmovae ecx, edx
cmp ecx, dword [ebp - 0xc]
jb 0x1003df5f
mov edx, esi
mov ecx, ebx
call fcn.1005c100
inc esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp esi, dword [ebp - 8]
jl 0x1003df30
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call dword [0x10120e98]
cmp eax, 0xffffffff
jne 0x1003df85
push str._n_Error_unlocking_transition...
call fcn.10016d10
add esp, 4
push str._nFinished_transition...
call fcn.10016d10
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca534
call esi
mov eax, 0x1003e460
mov byte [0x4ca534], 0xe9
sub eax, 0x4ca539
mov dword [0x4ca535], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca534
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca34c
call esi
mov eax, 0x1003e470
mov byte [0x4ca34c], 0xe9
sub eax, 0x4ca351
mov dword [0x4ca34d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca34c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca0ac
call esi
mov eax, 0x1003e480
mov byte [0x4ca0ac], 0xe9
sub eax, 0x4ca0b1
mov dword [0x4ca0ad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca0ac
call esi
pop esi
pop ecx
ret
Function at 0x1003edc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44e92c
call esi
mov eax, 0x1003e270
sub eax, 0x44e930
mov dword [0x44e92c], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44e92c
call esi
call fcn.1003e490
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d7814
call esi
mov eax, 0x1003edb0
mov byte [0x4d7814], 0xe9
sub eax, 0x4d7819
mov dword [0x4d7815], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d7814
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x482057
call esi
mov eax, 0x1003ed20
sub eax, 0x48205b
mov dword [0x482057], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x482057
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x48208a
call esi
mov eax, 0x1003ed30
sub eax, 0x48208e
mov dword [0x48208a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x48208a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47ed24
call esi
mov eax, 0x1003ed70
sub eax, 0x47ed28
mov dword [0x47ed24], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47ed24
call esi
pop esi
pop ecx
ret

Function at 0x1003f5c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d36d4
call esi
mov eax, fcn.1003eed0
mov byte [0x4d36d4], 0xe9
sub eax, 0x4d36d9
mov dword [0x4d36d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d36d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d3704
call esi
mov eax, fcn.1003efa0
mov byte [0x4d3704], 0xe9
sub eax, 0x4d3709
mov dword [0x4d3705], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d3704
call esi
pop esi
pop ecx
ret

Function at 0x10040670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.1003f5c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48f1b0
call esi
mov eax, 0x10040640
mov byte [0x48f1b0], 0xe9
sub eax, 0x48f1b5
mov dword [0x48f1b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48f1b0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4897ec
call esi
mov eax, 0x10040650
mov byte [0x4897ec], 0xe9
sub eax, 0x4897f1
mov dword [0x4897ed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4897ec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x489550
call esi
mov eax, 0x10040660
mov byte [0x489550], 0xe9
sub eax, 0x489555
mov dword [0x489551], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x489550
call esi
pop esi
pop ecx
ret
Function at 0x10040730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edx, 0x6639d0
mov edi, eax
push 0x3c
mov ecx, edx
call fcn.10017270
call esi
mov ecx, eax
movss xmm1, dword [0x1013cd98]
mov esi, eax
sub ecx, edi
sub esi, edi
cmp eax, edi
mov eax, 0x20
cmovae esi, ecx
test esi, esi
cmove esi, eax
xor edx, edx
mov eax, 0xa410
div esi
ucomiss xmm1, dword [0x101327c8]
mov ecx, eax
lahf
test ah, 0x44
jnp 0x10040793
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
cvttss2si ecx, xmm0
push ecx
push esi
push str._nFade_time_is__u__steps_are__d_n
mov dword [0x6642d0], ecx
call fcn.10016d10
add esp, 0xc
pop edi
pop esi
pop ecx
ret

Function at 0x10040a20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e97c
call esi
mov eax, 0x10040f90
mov byte [0x42e97c], 0xe9
sub eax, 0x42e981
mov dword [0x42e97d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e97c
call esi
push 0x64
mov edx, str.FadeMultiplier
mov ecx, str.Graphics
call fcn.1000dcb0
cmp eax, 0x64
je 0x10040a97
test eax, eax
mov ecx, 1
cmovle eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x10132790]
movss dword [0x1013cd98], xmm0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x493a00
call esi
mov eax, 0x100407b0
mov byte [0x493a00], 0xe9
sub eax, 0x493a05
mov dword [0x493a01], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x493a00
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x493ad4
call esi
mov eax, 0x100409a0
mov byte [0x493ad4], 0xe9
sub eax, 0x493ad9
mov dword [0x493ad5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x493ad4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x493b48
call esi
mov eax, 0x100409b0
mov byte [0x493b48], 0xe9
sub eax, 0x493b4d
mov dword [0x493b49], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x493b48
call esi
pop esi
pop ecx
ret
Function at 0x10040fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [ecx + 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
push edi
test esi, esi
je 0x1004115d
mov eax, dword [esi + 0x78]
test eax, eax
je 0x10040fca
mov esi, eax
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x10040fc1
mov dword [esp + 0x2c], 0x10016cb0
mov edx, dword [esi + 4]
and edx, 0x2000000
mov dword [esp + 0x28], edx
cmp edx, dword [esp + 0x44]
jne 0x10041152
mov edi, dword [esi + 0x48]
test edi, edi
je 0x10041152
movups xmm0, xmmword [esi + 8]
mov ebx, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
movd eax, xmm0
movups xmmword [esp + 0x30], xmm0
add dword [esp + 0x34], ebp
add dword [esp + 0x38], ebx
add eax, ebx
add dword [esp + 0x3c], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10041060
lea ecx, [esp + 0x30]
mov edx, eax
push ecx
call fcn.1003b8a0
cmp eax, 0xffffffff
je 0x1004114e
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
sub ecx, ebx
mov dword [esp + 0x20], eax
sub eax, ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
sub eax, ebp
sub ebx, ebp
jmp 0x10041070
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x30]
cmp edi, eax
jne 0x10041087
test dword [esi + 4], 0x20000
je 0x10041087
mov edi, dword [esi + 0x34]
test byte [esi + 4], 8
je 0x100410aa
cmp edi, eax
jne 0x10041096
mov edi, dword [esi + 0x3c]
jmp 0x100410c5
cmp edi, dword [esi + 0x34]
jne 0x100410a0
mov edi, dword [esi + 0x40]
jmp 0x100410c5
cmp edi, dword [esi + 0x38]
jne 0x100410c5
mov edi, dword [esi + 0x44]
jmp 0x100410c5
cmp edi, dword [esi + 0x3c]
jne 0x100410b3
mov edi, eax
jmp 0x100410c5
cmp edi, dword [esi + 0x40]
jne 0x100410bd
mov edi, dword [esi + 0x34]
jmp 0x100410c5
cmp edi, dword [esi + 0x44]
jne 0x100410c5
mov edi, dword [esi + 0x38]
test edi, edi
je 0x1004114e
sub ecx, dword [esp + 0x10]
mov eax, 0x10016ca0
mov ebp, dword [esi + 0x10]
inc ecx
sub ebp, dword [esi + 8]
mov dword [esp + 0x24], ecx
inc ebp
mov ecx, dword [esp + 0x18]
sub ebx, ecx
sub ecx, dword [esi + 0xc]
inc ebx
imul ecx, ebp
sub ecx, dword [esi + 8]
add ecx, dword [esp + 0x10]
add ecx, edi
test byte [esi + 4], 0x20
cmovne eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
test edx, edx
je 0x10041128
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x1004114b
mov eax, dword [0x1013cf04]
push eax
imul eax, dword [esp + 0x38]
add eax, dword [0x51e3fc]
add eax, dword [esp + 0x24]
jmp 0x1004113c
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
push eax
imul eax, dword [esp + 0x1c]
add eax, dword [edx + 0x2c]
add eax, dword [esp + 0x14]
push eax
push ebp
push ebx
push dword [esp + 0x34]
push ecx
call dword [esp + 0x40]
add esp, 0x18
mov dword [esi + 0x48], edi
mov ecx, dword [esp + 0x14]
mov esi, dword [esi + 0x74]
test esi, esi
jne 0x10040fd2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x100416e0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
call fcn.10040670
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4d6fd9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100416d0
mov byte [0x4d6fd9], 0xe9
sub eax, 0x4d6fde
mov dword [0x4d6fda], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4d6fd9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov dword [esp], 0x4c8fd1
push eax
lea edx, [esp + 4]
mov dword [esp + 8], 0x4c900d
mov ecx, 0x51e3fc
call fcn.10011f40
add esp, 8
ret

Function at 0x10044380
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
movzx eax, byte [0x461594]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1013cda4], eax
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45d880
call esi
mov eax, 0x10044300
mov byte [0x45d880], 0xe9
sub eax, 0x45d885
mov dword [0x45d881], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45d880
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45fd88
call esi
mov eax, 0x10044310
mov byte [0x45fd88], 0xe9
sub eax, 0x45fd8d
mov dword [0x45fd89], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45fd88
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45f838
call esi
mov eax, 0x10044320
mov byte [0x45f838], 0xe9
sub eax, 0x45f83d
mov dword [0x45f839], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45f838
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45ee0c
call esi
mov eax, 0x10044330
mov byte [0x45ee0c], 0xe9
sub eax, 0x45ee11
mov dword [0x45ee0d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45ee0c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x460ba0
call esi
mov eax, 0x10044340
mov byte [0x460ba0], 0xe9
sub eax, 0x460ba5
mov dword [0x460ba1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x460ba0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x461134
call esi
mov eax, 0x10044350
mov byte [0x461134], 0xe9
sub eax, 0x461139
mov dword [0x461135], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x461134
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x461454
call esi
mov eax, 0x10044360
mov byte [0x461454], 0xe9
sub eax, 0x461459
mov dword [0x461455], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x461454
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4614cc
call esi
mov eax, 0x10044370
mov byte [0x4614cc], 0xe9
sub eax, 0x4614d1
mov dword [0x4614cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4614cc
call esi
pop esi
pop ecx
ret
Function at 0x10044b30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x470650
call esi
mov eax, 0x10044b10
mov byte [0x470650], 0xe9
sub eax, 0x470655
mov dword [0x470651], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x470650
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4705a0
call esi
mov eax, 0x10044b20
mov byte [0x4705a0], 0xe9
sub eax, 0x4705a5
mov dword [0x4705a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4705a0
call esi
pop esi
pop ecx
ret
Function at 0x10049600
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44cfa0
call esi
mov eax, 0x10041de0
mov byte [0x44cfa0], 0xe9
sub eax, 0x44cfa5
mov dword [0x44cfa1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44cfa0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x473904
call esi
mov eax, 0x1004ed10
mov byte [0x473904], 0xe9
sub eax, 0x473909
mov dword [0x473905], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x473904
call esi
call fcn.1004b780
call fcn.1004c9b0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47688c
call esi
mov eax, 0x10045500
mov byte [0x47688c], 0xe9
sub eax, 0x476891
mov dword [0x47688d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47688c
call esi
push 0xffffffffffffffff
mov edx, str.ReloadReserve
mov ecx, str.Misc
call fcn.1000dcb0
mov ecx, dword [0x1013cda8]
test eax, eax
cmovns ecx, eax
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x470c2c
mov dword [0x1013cda8], ecx
call esi
mov eax, 0x10049590
mov byte [0x470c2c], 0xe9
sub eax, 0x470c31
mov dword [0x470c2d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x470c2c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x46fdf4
call esi
mov eax, 0x100495c0
mov byte [0x46fdf4], 0xe9
sub eax, 0x46fdf9
mov dword [0x46fdf5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x46fdf4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47036c
call esi
mov eax, 0x100495d0
mov byte [0x47036c], 0xe9
sub eax, 0x470371
mov dword [0x47036d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47036c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47304c
call esi
mov eax, 0x100495b0
mov byte [0x47304c], 0xe9
sub eax, 0x473051
mov dword [0x47304d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47304c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x46ec90
call esi
mov eax, 0x100495a0
mov byte [0x46ec90], 0xe9
sub eax, 0x46ec95
mov dword [0x46ec91], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x46ec90
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472b54
call esi
mov eax, 0x100495e0
mov byte [0x472b54], 0xe9
sub eax, 0x472b59
mov dword [0x472b55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472b54
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x476394
call esi
mov eax, 0x100495f0
mov byte [0x476394], 0xe9
sub eax, 0x476399
mov dword [0x476395], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x476394
call esi
pop esi
pop ecx
ret
Function at 0x1004b780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10019780
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4454de
call esi
mov eax, 0x10049890
mov byte [0x4454de], 0xe8
sub eax, 0x4454e3
mov dword [0x4454df], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4454de
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4757f0
call esi
mov eax, 0x1004b770
mov byte [0x4757f0], 0xe9
sub eax, 0x4757f5
mov dword [0x4757f1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4757f0
call esi
pop esi
pop ecx
ret

Function at 0x1004c9b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x471d5c
call esi
mov eax, fcn.1004b800
mov byte [0x471d5c], 0xe9
sub eax, 0x471d61
mov dword [0x471d5d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x471d5c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472d24
call esi
mov eax, 0x1004c9a0
mov byte [0x472d24], 0xe9
sub eax, 0x472d29
mov dword [0x472d25], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472d24
call esi
pop esi
pop ecx
ret