joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100635f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10063637
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100890df
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x18]
push 0
push eax
push 6
lea eax, [ebp - 0x20]
push eax
push edi
call ebx
mov eax, 0x1112
cmp word [ebp - 0x20], ax
jne 0x10063750
cmp dword [ebp - 0x1e], 0x36
jne 0x10063750
cmp byte [ebp + 0x10], 0
mov eax, 0x1014aa2c
push esi
push 0
mov esi, 0x1014aa5c
cmove esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0x1014aa8c]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0x1014aa90]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0x1014aa94]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
xor eax, dword [0x1014aa98]
push 0
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0x1014aa8c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0x1014aa90]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0x1014aa94]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
xor eax, dword [0x1014aa98]
push 0
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0x1014aa8c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0x1014aa90]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0x1014aa94]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
xor eax, dword [0x1014aa98]
push edi
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100890df
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
xor ecx, ebp
pop edi
call fcn.100890df
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10069970
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x10069a3f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x10069a6e
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x10069a7a
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x10069a86
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x10069a92
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x10069a9e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x10069aaa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013a31e], 0
push ebx
push esi
mov esi, ecx
jne 0x10069992
call fcn.1006a6d0
mov eax, dword [esi + 0x48]
xor ecx, ecx
mov dword [0x1014ef80], eax
mov eax, dword [esi + 0x4c]
mov dword [0x1014ef78], eax
mov eax, dword [esi + 0x50]
mov dword [0x1014ee78], eax
mov eax, dword [esi + 0x54]
mov dword [0x1014ee74], eax
mov eax, dword [esi + 0x58]
mov dword [0x1014ee80], eax
mov eax, dword [esi + 0x5c]
mov dword [0x1014ef74], eax
mov eax, dword [esi + 0x60]
mov dword [0x1014ee7c], eax
mov eax, dword [esi + 0x64]
mov dword [0x1014ef70], eax
mov eax, dword [esi + 0x68]
mov dword [0x1014ef6c], eax
mov eax, dword [esi + 0x6c]
mov dword [0x1014ef68], eax
mov eax, dword [esi + 0x70]
mov dword [0x1014ef2c], eax
mov eax, dword [esi + 0x74]
mov dword [0x1014ef28], eax
mov eax, dword [esi + 0x78]
mov dword [0x1014ef24], eax
mov eax, dword [esi + 0x7c]
mov dword [0x1014ef20], eax
mov eax, dword [esi + 0x80]
mov dword [0x1014ef1c], eax
mov eax, dword [0x7bc4f04]
mov word [eax + 0x7e], cx
mov eax, dword [0x7bc4f04]
mov byte [eax + 0x30c], cl
mov eax, dword [0x8128ac8]
movzx eax, byte [eax + 0xb]
and eax, 7
cmp eax, 6
ja case.default.0x10069a38
jmp dword [eax*4 + 0x10069af0]
cmp dword [0x10149d08], 0xffff
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x556c38
add bl, 2
call esi
mov byte [0x556c38], bl
jmp 0x10069ac6
cmp dword [0x10149d0c], 0xffff
jmp 0x10069a49
cmp dword [0x10149d10], 0xffff
jmp 0x10069a49
cmp dword [0x10149d14], 0xffff
jmp 0x10069a49
cmp dword [0x10149d18], 0xffff
jmp 0x10069a49
cmp dword [0x10149d1c], 0xffff
jmp 0x10069a49
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556c38
call esi
mov byte [0x556c38], 0xf
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x556c38
call esi
mov ecx, 0x1013a328
call fcn.10009b20
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x1006c2b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
movzx esi, dx
mov edi, ecx
push esi
call fcn.1008960e
push esi
mov ebx, eax
push 0x90
push ebx
call fcn.100d71f0
add esp, 0x10
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1006c30f
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100890df
mov esp, ebp
pop ebp
ret
push esi
push ebx
push edi
call fcn.100d6c70
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1006c2f8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret

Function at 0x1006c370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100890df
mov esp, ebp
pop ebp
ret

Function at 0x1006c3c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp + 8]
cmp al, 0xff
je 0x1006c3ec
mov byte [esi], al
mov eax, dword [ebp + 0x10]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100890df
mov esp, ebp
pop ebp
ret

Function at 0x1006c420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push 0x40
push ebx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.100d6c70
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret
Function at 0x1006c480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 8]
mov esi, edx
push eax
push 0x40
mov ebx, ecx
mov dword [ebp - 0xc], esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
mov ecx, 0xffffffff
add eax, 5
cmovb eax, ecx
push eax
call fcn.100e0d98
push dword [ebp - 0xc]
mov esi, eax
push ebx
push esi
call fcn.100d6c70
mov eax, dword [ebp - 0xc]
mov ecx, ebx
sub ecx, esi
sub ecx, 5
mov byte [eax + esi], 0xe9
mov dword [eax + esi + 1], ecx
add eax, 0xfffffffb
push eax
sub esi, ebx
mov byte [ebx], 0xe9
lea eax, [ebx + 5]
sub esi, 5
push 0x90
push eax
mov dword [ebx + 1], esi
call fcn.100d71f0
add esp, 0x1c
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100890df
mov esp, ebp
pop ebp
ret