joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100108b0
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x110
push esi
lea eax, [esp + 4]
mov dword [esp + 8], 0x104
push eax
mov eax, dword [esp + 0x11c]
mov esi, edx
or eax, 0x20001
push eax
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x100109b3
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100109a9
cmp dword [esp + 8], eax
je 0x100109a9
mov eax, dword [esp + 0xc]
cmp eax, 2
je 0x1001092e
cmp eax, 7
je 0x1001092e
cmp eax, 1
jne 0x100109a9
lea eax, [esp + 0x10]
push str.256COLOR
push eax
call fcn.100ec2c0
add esp, 8
test eax, eax
jne 0x10010970
lea eax, [esp + 0x10]
push str.640X480
push eax
call fcn.100ec2c0
add esp, 8
test eax, eax
jne 0x10010970
lea eax, [esp + 0x10]
push 0x10120250
push eax
call fcn.100ec2c0
add esp, 8
test eax, eax
je 0x100109a9
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x10174f82], 0
mov ecx, str.Fallout_appears_to_be_running_in_compatibility_mode._nPlease_check_the_compatibility_tab_of_fallout2.exe__and_ensure_that_the_all_settings_are_unchecked._nIf_these_options_are_disabled__click_the__Change_settings_for_all_users__button.If_nothing_helps__set_the_SkipCompatModeCheck_option_in_ddraw.ini_to_1.
push 0x2010
push str.sFall_v5.0.7.0
mov eax, 0x1011ff70
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x110
ret 4
Function at 0x10010fa0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x208
lea eax, [esp + 0x104]
mov edx, str.WrapperDLL
mov ecx, 0x1011f8fc
push esi
push edi
push 0x104
push eax
push 0x1011f824
call fcn.1000dde0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10011023
push 4
mov edx, str.Mode
mov ecx, str.Graphics
call fcn.1000dcb0
cmp eax, 3
ja 0x10011023
mov ecx, 2
call fcn.1007b350
cmp eax, 1
je 0x10010ffc
test eax, eax
jne 0x10011023
push 0x104
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.100f730d
add esp, 0xc
lea eax, [esp + 8]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x10011067
push 0xf9
lea eax, [esp + 0xc]
mov byte [0x1013ca25], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movq xmm0, qword [0x10120564]
lea ecx, [esp + 8]
add ecx, eax
mov ax, word [0x1012056c]
movq qword [ecx], xmm0
mov word [ecx + 8], ax
mov al, byte [0x1012056e]
mov byte [ecx + 0xa], al
lea eax, [esp + 8]
push eax
call esi
mov edi, eax
mov dword [0x10142bbc], edi
test edi, edi
je 0x100111a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10120570
push edi
call esi
push 0x10120584
push edi
mov dword [0x10142bcc], eax
call esi
push 0x10120594
push edi
mov dword [0x10142bd4], eax
call esi
push 0x101205b0
push edi
mov dword [0x10142bd8], eax
call esi
push 0x101205c8
push edi
mov dword [0x10142bdc], eax
call esi
push 0x101205e0
push edi
mov dword [0x10142be0], eax
call esi
push 0x101205f0
push edi
mov dword [0x10142be4], eax
call esi
push 0x10120604
push edi
mov dword [0x10142be8], eax
call esi
push 0x10120610
push edi
mov dword [0x10142bec], eax
call esi
push 0x10120628
push edi
mov dword [0x10142bf0], eax
call esi
push 0x1012063c
push edi
mov dword [0x10142bc4], eax
call esi
push 0x10120650
push edi
mov dword [0x10142bc8], eax
call esi
push 0x10120668
push edi
mov dword [0x10142bf4], eax
call esi
push 0x10120680
push edi
mov dword [0x10142bc0], eax
call esi
push 0x10120698
push edi
mov dword [0x10142bf8], eax
call esi
push 0x101206b0
push edi
mov dword [0x10142bfc], eax
call esi
push 0x101206c0
push edi
mov dword [0x10142c00], eax
call esi
push 0x101206d4
push edi
mov dword [0x10142c04], eax
call esi
push 0x101206e8
push edi
mov dword [0x10142c08], eax
call esi
push 0x101206f8
push edi
mov dword [0x10142c0c], eax
call esi
mov dword [0x10142c10], eax
push 0x1012070c
push edi
call esi
push 0x10120720
push edi
mov dword [0x10142c14], eax
call esi
push 0x10120734
push edi
mov dword [0x10142bd0], eax
call esi
mov dword [0x10142c18], eax
pop edi
pop esi
add esp, 0x208
ret
Function at 0x100111b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [esp + 8]
sub eax, 0
je 0x100112ba
sub eax, 1
jne 0x10011280
mov eax, dword [esp + 4]
push esi
push 0xe
push str.FALLOUT_Mapper
push 0x53c938
mov dword [0x10142bb8], eax
call fcn.100f71c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
test eax, eax
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
je 0x10011285
push 0x4de8de
call esi
mov eax, 0x100109c0
mov byte [0x4de8de], 0xe8
sub eax, 0x4de8e3
mov dword [0x4de8df], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push 0x4de8de
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x4de8e5
call esi
lea eax, [esp + 0xc]
mov byte [0x4de8e5], 0xeb
push eax
push dword [esp + 0x10]
push 1
push 0x4de8e5
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x4de8e6
call esi
lea eax, [esp + 0xc]
mov dword [0x4de8e6], 0x7f
push eax
push dword [esp + 0x10]
push 4
push 0x4de8e6
call esi
pop esi
mov al, 1
ret 0xc
push 0x506a82
call esi
mov eax, 0x10010f80
mov byte [0x506a82], 0xe8
sub eax, 0x506a87
mov dword [0x506a83], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push 0x506a82
call esi
pop esi
mov al, 1
ret 0xc
mov eax, dword [0x10142bbc]
test eax, eax
je 0x10011280
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
ret 0xc

Function at 0x10011f40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, edx
mov dword [esp + 0xc], ecx
sub ebp, edi
xor ecx, ecx
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x14]
cmova ebp, ecx
test ebp, ebp
je 0x10011f99
push esi
mov esi, dword [edi]
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
mov dword [esi], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x10011f66
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x100120f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov bl, cl
lea ecx, [esp + 0x1c]
mov ebp, edx
push ecx
push 0x40
lea eax, [edi + 5]
push eax
push ebp
mov dword [esp + 0x20], eax
lea esi, [ebp + 5]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
sub eax, esi
mov byte [ebp], bl
mov dword [ebp + 1], eax
mov byte [esi], 0x90
lea esi, [esi + 1]
sub edi, 1
jne 0x10012122
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x10012150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov esi, edx
push eax
push 0x40
push 8
push 0x444a64
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
mov ecx, 0x444a64
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ecx
ret 4

Function at 0x10012190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
push 0x40
push 1
push edi
mov bl, dl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov byte [edi], bl
push eax
push dword [esp + 0xc]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x100121c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push edi
lea eax, [esp + 8]
mov ebx, ecx
push eax
push 0x40
push 4
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov dword [ebx], edi
push eax
push dword [esp + 0xc]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x100121f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push 0x40
push 4
lea ebp, [esi + 1]
mov ebx, edx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
sub ebx, esi
push eax
push dword [esp + 0x10]
sub ebx, 5
push 4
push ebp
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10012230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push edi
lea eax, [esp + 8]
mov ebx, ecx
push eax
push 0x40
push 5
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov byte [ebx], 0xe8
push eax
push dword [esp + 0xc]
sub edi, ebx
push 5
sub edi, 5
push ebx
mov dword [ebx + 1], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x10012270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push edi
lea eax, [esp + 8]
mov ebx, ecx
push eax
push 0x40
push 5
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov byte [ebx], 0xe9
push eax
push dword [esp + 0xc]
sub edi, ebx
push 5
sub edi, 5
push ebx
mov dword [ebx + 1], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret
Function at 0x100122b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
sub ebx, ebp
add ebx, 3
mov dword [esp + 0x10], ecx
shr ebx, 2
xor ecx, ecx
cmp ebp, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
cmova ebx, ecx
test ebx, ebx
je 0x10012325
push esi
push edi
mov esi, dword [ebp]
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
lea edi, [esi + 1]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
sub eax, esi
sub eax, 5
mov dword [edi], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x14]
lea ebp, [ebp + 4]
inc eax
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x100122e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x10012330
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
sub ebx, edi
mov dword [esp + 0x10], ecx
add ebx, 3
xor ecx, ecx
shr ebx, 2
cmp edi, dword [esp + 0x1c]
cmova ebx, ecx
test ebx, ebx
je 0x1001239c
push esi
nop word [eax + eax]
mov esi, dword [edi]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x14]
sub eax, esi
mov byte [esi], 0xe8
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebp
lea edi, [edi + 4]
cmp ebp, ebx
jne 0x10012360
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10012910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010eba7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x10120c08
mov dword [edi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.1000bff0
lea ebx, [edi + 4]
mov dword [esi + 0x3c], 0
push 0x20
mov ecx, esi
mov dword [esi + 0x38], ebx
call fcn.10008ca0
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x100129aa
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.1000cf50
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov dword [ebp - 0x18], ebx
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x10120a20
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov ecx, ebx
call fcn.10008340
lea eax, [ebx + 4]
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [ebx + 0xc], eax
lea ecx, [ebx + 8]
lea eax, [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov dword [ebx + 0x4c], 0
mov eax, dword [0x10142b9c]
mov dword [ebx + 0x40], eax
mov eax, dword [0x10142ba0]
mov dword [ebx + 0x44], eax
mov eax, edi
pop edi
mov dword [ebx + 0x38], 0
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10013c80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10013c93
test al, 0x10
jne 0x10013c93
mov al, 1
ret
xor al, al
ret

Function at 0x10015780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4de9fc
call esi
mov eax, 0x10014cd0
mov byte [0x4de9fc], 0xe9
sub eax, 0x4dea01
mov dword [0x4de9fd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4de9fc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c9bd9
call esi
lea eax, [esp + 4]
mov dword [0x4c9bd9], 0x1000f320
push eax
push dword [esp + 8]
push 4
push 0x4c9bd9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481b2b
call esi
mov eax, 0x10015760
sub eax, 0x481b2f
mov dword [0x481b2b], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x481b2b
call esi
pop esi
pop ecx
ret

Function at 0x10018e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push 0
mov edx, str.GraveContainersFix
mov ecx, str.Misc
call fcn.1000dcb0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x413970
setg byte [0x1015539e]
call esi
mov eax, 0x10018e40
mov byte [0x413970], 0xe9
sub eax, 0x413975
mov dword [0x413971], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x413970
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x412134
call esi
mov eax, 0x10018e50
mov byte [0x412134], 0xe9
sub eax, 0x412139
mov dword [0x412135], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x412134
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x411f2c
call esi
mov eax, 0x10018e60
mov byte [0x411f2c], 0xe9
sub eax, 0x411f31
mov dword [0x411f2d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x411f2c
call esi
pop esi
pop ecx
ret

Function at 0x10019780
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 1
mov edx, str.CanSellUsedGeiger
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
je 0x100197e8
cmp byte [0x10174f84], 0
je 0x100197e1
test byte [0x10174f88], 0x10
je 0x100197e1
mov edx, str.Applying_fix_patch_to_be_able_to_sell_used_geiger_counters_and_stealth_boys.
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x100197e1
mov edx, str.Applying_fix_patch_to_be_able_to_sell_used_geiger_counters_and_stealth_boys.
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
mov byte [0x10174f93], 1
lea eax, [esp]
push eax
push 0x40
push 5
push 0x474b2c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10019770
mov byte [0x474b2c], 0xe9
sub eax, 0x474b31
mov dword [0x474b2d], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x474b2c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x1001b810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b3b54
call esi
mov eax, 0x100251b0
mov byte [0x4b3b54], 0xe9
sub eax, 0x4b3b59
mov dword [0x4b3b55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b3b54
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d8a8
call esi
mov eax, 0x1001b770
mov byte [0x42d8a8], 0xe9
sub eax, 0x42d8ad
mov dword [0x42d8a9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d8a8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d974
call esi
mov eax, 0x1001b780
mov byte [0x42d974], 0xe9
sub eax, 0x42d979
mov dword [0x42d975], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d974
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d9b4
call esi
mov eax, 0x1001b790
mov byte [0x42d9b4], 0xe9
sub eax, 0x42d9b9
mov dword [0x42d9b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d9b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472768
call esi
mov eax, 0x1001b7a0
mov byte [0x472768], 0xe9
sub eax, 0x47276d
mov dword [0x472769], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472768
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472a64
call esi
mov eax, 0x1001b7b0
mov byte [0x472a64], 0xe9
sub eax, 0x472a69
mov dword [0x472a65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472a64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d318
call esi
mov eax, 0x1001b7c0
mov byte [0x42d318], 0xe9
sub eax, 0x42d31d
mov dword [0x42d319], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d318
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d3a4
call esi
mov eax, 0x1001b7d0
mov byte [0x42d3a4], 0xe9
sub eax, 0x42d3a9
mov dword [0x42d3a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d3a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d210
call esi
mov eax, 0x1001aab0
mov byte [0x42d210], 0xe9
sub eax, 0x42d215
mov dword [0x42d211], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d210
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d0a8
call esi
mov eax, 0x1001b7e0
mov byte [0x42d0a8], 0xe9
sub eax, 0x42d0ad
mov dword [0x42d0a9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d0a8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e32c
call esi
mov eax, 0x1001b7f0
mov byte [0x42e32c], 0xe9
sub eax, 0x42e331
mov dword [0x42e32d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e32c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d4f4
call esi
mov eax, 0x1001b800
mov byte [0x42d4f4], 0xe9
sub eax, 0x42d4f9
mov dword [0x42d4f5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d4f4
call esi
pop esi
pop ecx
ret
Function at 0x1001c450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a5b4
call esi
mov eax, 0x1001c410
mov byte [0x47a5b4], 0xe9
sub eax, 0x47a5b9
mov dword [0x47a5b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a5b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x479c20
call esi
mov eax, 0x1001c420
mov byte [0x479c20], 0xe9
sub eax, 0x479c25
mov dword [0x479c21], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x479c20
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a4c4
call esi
mov eax, 0x1001c430
mov byte [0x47a4c4], 0xe9
sub eax, 0x47a4c9
mov dword [0x47a4c5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a4c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a558
call esi
mov eax, 0x1001c440
mov byte [0x47a558], 0xe9
sub eax, 0x47a55d
mov dword [0x47a559], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a558
call esi
pop esi
pop ecx
ret

Function at 0x1001d0b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
mov ecx, 0x1001c540
push esi
sub esp, 0x28
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x1001d0d9
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x1001c540
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154dd0
push eax
call fcn.1001d210
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1001d122
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45ea10
call esi
mov eax, 0x1001d070
mov byte [0x45ea10], 0xe9
sub eax, 0x45ea15
mov dword [0x45ea11], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45ea10
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45efec
call esi
mov eax, 0x1001d080
mov byte [0x45efec], 0xe9
sub eax, 0x45eff1
mov dword [0x45efed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45efec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45eda8
call esi
mov eax, 0x1001d090
mov byte [0x45eda8], 0xe9
sub eax, 0x45edad
mov dword [0x45eda9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45eda8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45ebd8
call esi
mov eax, 0x1001d0a0
mov byte [0x45ebd8], 0xe9
sub eax, 0x45ebdd
mov dword [0x45ebd9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45ebd8
call esi
pop esi
add esp, 0x10
ret
Function at 0x1001db30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov edi, edx
mov ecx, dword [ebx + 0x64]
cmp dword [edi + 0x64], ecx
jne 0x1001dc01
mov eax, dword [ebx + 0x78]
cmp eax, dword [edi + 0x78]
jne 0x1001dc01
cmp dword [edi], 0xfffffff
jg 0x1001dc01
test dword [ebx + 0x24], 0x7002000
jne 0x1001dc01
test dword [edi + 0x24], 0x7002000
jne 0x1001dc01
lea edx, [esp + 0x18]
call fcn.1003bde0
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x20]
cmp eax, 1
je 0x1001dc01
cmp dword [ebx + 0x2c], 0
lea esi, [ebx + 0x2c]
jg 0x1001dc01
cmp dword [edi + 0x2c], 0
lea ebp, [edi + 0x2c]
jg 0x1001dc01
cmp eax, 4
je 0x1001dbb2
cmp dword [ebx + 0x64], 0x29
je 0x1001dbb2
mov byte [esp + 0x17], 0
jmp 0x1001dbc4
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov byte [esp + 0x17], 1
mov dword [edi + 0x3c], eax
xor edx, edx
sub ebp, esi
nop dword [eax + eax]
mov ecx, dword [esi]
lea esi, [esi + 4]
mov eax, dword [esi + ebp - 4]
cmp ecx, eax
jne 0x1001dbe3
inc edx
cmp edx, 0xe
jl 0x1001dbd0
cmp byte [esp + 0x17], 0
je 0x1001dbf1
mov eax, dword [esp + 0x18]
mov dword [edi + 0x3c], eax
xor eax, eax
cmp edx, 0xe
setge al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret