joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004f00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10005056
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.1002ea92
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10004fb9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10004f77
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000504c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x10004fcd
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10004fd0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1000504c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.1002ea92
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1000505d
cmp esi, eax
jne 0x10005027
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10004fe0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10005650
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
mov eax, ebx
imul ecx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x50]
xor eax, ebx
imul ebx, eax, 0x1000193
lea eax, [ebp + 0xc]
push ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.100015f0
mov edx, dword [eax + 4]
test edx, edx
je 0x100056fa
mov ecx, dword [edi + 0x68]
mov eax, dword [edi + 0x5c]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x100056d7
cmp eax, edx
jne 0x100056cf
mov eax, dword [edi + 0x54]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100056df
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x100056df
cmp eax, edx
jne 0x100056df
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 0x58]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.1002ea92
add esp, 8
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp + 8]
imul ebx, ecx, 0x1000193
lea ecx, [edi + 0x10]
push ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.100015f0
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x10005749
mov ecx, dword [edi + 0x14]
cmp ecx, dword [edi + 0x14]
je 0x100057c6
mov eax, dword [ecx + 0x10]
cmp eax, 1
jne 0x100057c2
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.100015f0
mov edx, dword [eax + 4]
test edx, edx
je 0x100057c6
mov ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x1c]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x10005796
cmp eax, edx
jne 0x1000578e
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1000579e
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x1000579e
cmp eax, edx
jne 0x1000579e
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 0x18]
mov eax, dword [edx + 4]
push 0x14
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.1002ea92
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
dec eax
mov dword [ecx + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10006ce0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 4]
test edx, edx
jne 0x10006cfd
mov edx, dword [ecx + 0xc]
lea eax, [edx + 1]
mov dword [ecx + 0xc], eax
mov dword [esi + 4], edx
lea esi, [ecx + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp + 0xc], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100015f0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10006d69
cmp ecx, dword [esi + 4]
je 0x10006d69
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
pop esi
mov dword [eax], ecx
mov al, 1
mov esp, ebp
pop ebp
ret 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10006e60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051705
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.100015f0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10006ee2
mov dword [esi], eax
xor al, al
jmp 0x10006f94
cmp dword [edi + 8], 0x15555555
je 0x10006fb4
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.1002ea62
mov dword [ebp - 0x18], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [ebx]
mov dword [ebp + 0xc], ecx
mov dword [ecx], eax
mov eax, dword [edi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100558f0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100558f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x10006f7e
mov ecx, edi
call fcn.10004b00
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push ebx
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.100015f0
mov ecx, dword [eax]
jmp 0x10006f84
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, edi
call fcn.10004a10
mov dword [esi], eax
mov al, 1
mov edx, 4
mov ecx, esi
mov byte [ecx + edx], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10017002
int3
Function at 0x10007a40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005173d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x48]
je 0x10007bdc
test ecx, ecx
jne 0x10007b94
push dword [edi + 0x28]
call fcn.100057d0
add esp, 4
mov dword [edi + 0x34], eax
mov ecx, edi
call fcn.10005810
mov dword [edi + 0x48], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x34]
mov dword [ebp - 4], 0
push dword [edi + 0x28]
call ebx
test eax, eax
je 0x10007b7e
push dword [edi + 0x34]
lea eax, [ebp + 8]
push eax
call fcn.10001de0
lea esi, [edi + 0x2c]
add esp, 8
cmp esi, eax
je 0x10007afe
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x10007afe
push eax
call fcn.1002eaa9
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x10007b0e
push eax
call fcn.1002eaa9
add esp, 4
push dword [edi + 0x34]
push dword [edi + 0x28]
push dword [esi]
call fcn.10030610
mov esi, dword [edi + 0x28]
mov edx, dword [edi + 0x48]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x34]
sub eax, 5
push eax
mov eax, dword [edi + 0x28]
add eax, 5
push 0x90
push eax
call fcn.10030b90
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x34]
push dword [edi + 0x28]
call ebx
test eax, eax
jne 0x10007bfe
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x44]
mov edx, dword [edi + 0x40]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x10007bfe
test ecx, ecx
je 0x10007bfe
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x38]
push dword [eax + 0x20]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005173d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x48]
je 0x10007dcc
test ecx, ecx
jne 0x10007d84
push dword [edi + 0x28]
call fcn.100057d0
add esp, 4
mov dword [edi + 0x34], eax
mov ecx, edi
call fcn.10005c30
mov dword [edi + 0x48], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x34]
mov dword [ebp - 4], 0
push dword [edi + 0x28]
call ebx
test eax, eax
je 0x10007d6e
push dword [edi + 0x34]
lea eax, [ebp + 8]
push eax
call fcn.10001de0
lea esi, [edi + 0x2c]
add esp, 8
cmp esi, eax
je 0x10007cee
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x10007cee
push eax
call fcn.1002eaa9
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x10007cfe
push eax
call fcn.1002eaa9
add esp, 4
push dword [edi + 0x34]
push dword [edi + 0x28]
push dword [esi]
call fcn.10030610
mov esi, dword [edi + 0x28]
mov edx, dword [edi + 0x48]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x34]
sub eax, 5
push eax
mov eax, dword [edi + 0x28]
add eax, 5
push 0x90
push eax
call fcn.10030b90
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x34]
push dword [edi + 0x28]
call ebx
test eax, eax
jne 0x10007dee
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x44]
mov edx, dword [edi + 0x40]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x10007dee
test ecx, ecx
je 0x10007dee
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x38]
push dword [eax + 0x20]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b0c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005173d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x48]
je 0x1000b25c
test ecx, ecx
jne 0x1000b214
push dword [edi + 0x28]
call fcn.100057d0
add esp, 4
mov dword [edi + 0x34], eax
mov ecx, edi
call fcn.1000aca0
mov dword [edi + 0x48], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x34]
mov dword [ebp - 4], 0
push dword [edi + 0x28]
call ebx
test eax, eax
je 0x1000b1fe
push dword [edi + 0x34]
lea eax, [ebp + 8]
push eax
call fcn.10001de0
lea esi, [edi + 0x2c]
add esp, 8
cmp esi, eax
je 0x1000b17e
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x1000b17e
push eax
call fcn.1002eaa9
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000b18e
push eax
call fcn.1002eaa9
add esp, 4
push dword [edi + 0x34]
push dword [edi + 0x28]
push dword [esi]
call fcn.10030610
mov esi, dword [edi + 0x28]
mov edx, dword [edi + 0x48]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x34]
sub eax, 5
push eax
mov eax, dword [edi + 0x28]
add eax, 5
push 0x90
push eax
call fcn.10030b90
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x34]
push dword [edi + 0x28]
call ebx
test eax, eax
jne 0x1000b27e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x44]
mov edx, dword [edi + 0x40]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x1000b27e
test ecx, ecx
je 0x1000b27e
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x38]
push dword [eax + 0x20]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c310
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005173d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x48]
je 0x1000c4ac
test ecx, ecx
jne 0x1000c464
push dword [edi + 0x28]
call fcn.100057d0
add esp, 4
mov dword [edi + 0x34], eax
mov ecx, edi
call fcn.1000bad0
mov dword [edi + 0x48], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x34]
mov dword [ebp - 4], 0
push dword [edi + 0x28]
call ebx
test eax, eax
je 0x1000c44e
push dword [edi + 0x34]
lea eax, [ebp + 8]
push eax
call fcn.10001de0
lea esi, [edi + 0x2c]
add esp, 8
cmp esi, eax
je 0x1000c3ce
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x1000c3ce
push eax
call fcn.1002eaa9
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000c3de
push eax
call fcn.1002eaa9
add esp, 4
push dword [edi + 0x34]
push dword [edi + 0x28]
push dword [esi]
call fcn.10030610
mov esi, dword [edi + 0x28]
mov edx, dword [edi + 0x48]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x34]
sub eax, 5
push eax
mov eax, dword [edi + 0x28]
add eax, 5
push 0x90
push eax
call fcn.10030b90
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x34]
push dword [edi + 0x28]
call ebx
test eax, eax
jne 0x1000c4ce
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x44]
mov edx, dword [edi + 0x40]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x1000c4ce
test ecx, ecx
je 0x1000c4ce
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x38]
push dword [eax + 0x20]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c500
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005173d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x48]
je 0x1000c69c
test ecx, ecx
jne 0x1000c654
push dword [edi + 0x28]
call fcn.100057d0
add esp, 4
mov dword [edi + 0x34], eax
mov ecx, edi
call fcn.1000bef0
mov dword [edi + 0x48], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x34]
mov dword [ebp - 4], 0
push dword [edi + 0x28]
call ebx
test eax, eax
je 0x1000c63e
push dword [edi + 0x34]
lea eax, [ebp + 8]
push eax
call fcn.10001de0
lea esi, [edi + 0x2c]
add esp, 8
cmp esi, eax
je 0x1000c5be
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x1000c5be
push eax
call fcn.1002eaa9
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000c5ce
push eax
call fcn.1002eaa9
add esp, 4
push dword [edi + 0x34]
push dword [edi + 0x28]
push dword [esi]
call fcn.10030610
mov esi, dword [edi + 0x28]
mov edx, dword [edi + 0x48]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x34]
sub eax, 5
push eax
mov eax, dword [edi + 0x28]
add eax, 5
push 0x90
push eax
call fcn.10030b90
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x34]
push dword [edi + 0x28]
call ebx
test eax, eax
jne 0x1000c6be
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x44]
mov edx, dword [edi + 0x40]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x1000c6be
test ecx, ecx
je 0x1000c6be
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x38]
push dword [eax + 0x20]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4