joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001750
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1013dc80]
fld qword [eax]
push esi
fsub qword [0x10019e08]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x1013dc84]
lea ecx, [esp + 0xc]
fabs
push ecx
fstp qword [esp + 0x14]
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
fmul qword [0x10019e00]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push edx
fadd qword [0x10019df8]
push eax
push 8
push edi
fstp qword [edi]
call esi
mov ecx, dword [0x1013dc80]
fld qword [ecx]
mov edi, dword [0x1013dc88]
fsub qword [0x10019e08]
lea edx, [esp + 0xc]
push edx
push 0x40
push 8
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
fmul qword [0x10019e00]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
fadd qword [0x10019df8]
push ecx
push 8
push edi
fstp qword [edi]
call esi
mov edx, dword [0x1013dc80]
fld qword [edx]
mov edi, dword [0x1013dc8c]
fsub qword [0x10019e08]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea ecx, [esp + 0xc]
fmul qword [0x10019e00]
push ecx
push edx
push 4
fadd qword [0x10019df0]
push edi
fstp dword [edi]
call esi
mov eax, dword [0x1013dc80]
fld qword [eax]
mov edi, dword [0x1013dc90]
fsub qword [0x10019e08]
lea ecx, [esp + 0xc]
fabs
fstp qword [esp + 0x10]
push ecx
push 0x40
push 4
push edi
call esi
fld qword [esp + 0x10]
mov eax, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea edx, [esp + 0xc]
fmul qword [0x10019e00]
push edx
push eax
push 4
fadd qword [0x10019df0]
push edi
fstp dword [edi]
call esi
mov ecx, dword [0x1013dc80]
fld qword [ecx]
mov edi, dword [0x1013dc94]
fsub qword [0x10019e08]
lea edx, [esp + 0xc]
push edx
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov ecx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea eax, [esp + 0xc]
fmul qword [0x10019e00]
push eax
push ecx
push 4
fadd qword [0x10019de8]
push edi
fstp dword [edi]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100018e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [0x1013dc98], 0
push esi
push edi
je 0x10001ab7
mov edi, dword [0x1013dc74]
fld dword [0x1013dc9c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1013dca0]
mov edi, dword [0x1013dc78]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1013dca4]
mov edi, dword [0x1013dc7c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld qword [0x1013dca8]
mov edi, dword [0x1013dc80]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x1013dcb0]
mov edi, dword [0x1013dc84]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x1013dcb8]
mov edi, dword [0x1013dc88]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld dword [0x1013dcc0]
mov edi, dword [0x1013dc8c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1013dcc4]
mov edi, dword [0x1013dc90]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1013dcc8]
mov edi, dword [0x1013dc94]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
mov ecx, 3
call fcn.100037d0
test eax, eax
jne 0x10001add
mov eax, 0x1013dcd8
push 1
push eax
mov eax, 0x597630
call eax
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add eax, 4
push 1
push eax
mov eax, 0x597630
call eax
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001b90
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001ba0
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10001bac
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001bb6
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001bc0
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10001bca
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001bd4
or eax, 4
shr ecx, 1
test cl, 1
je 0x10001bde
or eax, 2
test cl, 2
je 0x10001be6
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001ca0
test al, 1
je 0x10001cad
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001ca0
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001b94
pop edi
pop ebx
ret

Function at 0x10001cd0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001932c
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001d02
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001d30
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001d93
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10001d79
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001d58
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001d50
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10003590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor eax, eax
push edi
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push getpeername
mov byte [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.MSVCR100.dll_strcpy_s]
test eax, eax
jne 0x10003613
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.LangSelection
push ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10003609
push 0x100193c4
lea edx, [ebp - 4]
push 4
push edx
call edi
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.MSVCR100.dll__stricmp]
lea ecx, [ebp - 4]
push 0x100193c4
push ecx
call esi
add esp, 8
test eax, eax
je 0x1000365f
lea edx, [ebp - 4]
push 0x100193c8
push edx
call esi
add esp, 8
test eax, eax
je 0x1000365f
lea eax, [ebp - 4]
push 0x100193cc
push eax
call esi
add esp, 8
test eax, eax
je 0x1000365f
push 0x100193c4
lea ecx, [ebp - 4]
push 4
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 4]
push 0x100193c8
push edx
call esi
add esp, 8
test eax, eax
jne 0x10003681
pop edi
mov dword [0x1013dcd4], 1
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push 0x100193cc
push eax
call esi
add esp, 8
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
pop edi
mov dword [0x1013dcd4], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003d40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a6b1f], 0
je 0x10003edb
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push 0xd461d0
call esi
fld qword [0x10019f98]
lea ecx, [ebp - 4]
fstp qword [0xd461d0]
mov edx, dword [ebp - 4]
push ecx
push edx
push 8
push 0xd461d0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push 0xd461b8
call esi
fld qword [0x10019f98]
lea ecx, [ebp - 4]
fstp qword [0xd461b8]
mov edx, dword [ebp - 4]
push ecx
push edx
push 8
push 0xd461b8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x80f270
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x80f270], 0xc3
mov edx, dword [ebp - 4]
push edx
push 1
push 0x80f270
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x7f
push 0x895b8d
call esi
push 0x7f
push 0x90
push 0x895b8d
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x7f
push 0x895b8d
call esi
push 0x10003ee0
push 0x80eef0
mov bl, 0xe9
call fcn.10016440
push 0x10004110
push 0x8118c0
call fcn.10016440
push 0x100047b0
push 0x80f8e0
call fcn.10016440
push 0x10004b30
push 0x80fa10
call fcn.10016440
push 0x10004fa0
push 0x810420
call fcn.10016440
push 0x10005160
push 0x810150
call fcn.10016440
push 0x100056c0
push 0x813740
call fcn.10016440
push 0x10005780
push 0x813970
call fcn.10016440
add esp, 0x40
push 0x10005b10
push 0x8126c0
call fcn.10016440
push 0x10006130
push 0x895a73
mov bl, 0xe8
call fcn.10016440
push 0x10006170
push 0x895ae8
call fcn.10016440
push 0x100061b0
push 0x895b5d
call fcn.10016440
push 0x100061f0
push 0x814e63
call fcn.10016440
add esp, 0x28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100067f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10006780
test eax, eax
je 0x100068e6
push ebx
push esi
push 0x10006a50
push 0x4d2882
mov bl, 0xe8
call fcn.10016440
push 0x10006a90
push 0x4d28eb
call fcn.10016440
push 0x10006ad0
push 0x4d2957
call fcn.10016440
push 0x10006a50
push 0x4d29c1
call fcn.10016440
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2887
call esi
mov bl, 0x90
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d2887], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d28f0
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d28f0], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d295c
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d295c], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d29c6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d29c6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d29c6
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.10007670
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 4
test al, al
je 0x100077a0
xor ecx, ecx
test edi, edi
jle 0x100077a0
mov dl, byte [0x1013ba3d]
mov al, dl
imul byte [0x1013ba3c]
push ebx
mov bl, byte [ecx + esi]
add bl, al
xor bl, dl
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x10007790
pop ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [0x1013ba40]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x100077c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x14], edi
lea esi, [ecx + 1]
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a69c8]
mov byte [ebp - 1], al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a69c9]
movzx edx, byte [edi + 0x100a695b]
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
mov eax, 0xf0f0f0f1
mul edi
mov edi, dword [ebp - 0xc]
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a69ca]
movzx edx, byte [edi + 0x100a695b]
mov byte [ebp - 5], al
mov byte [ebp - 4], dl
mov bl, byte [esi + 0x100a695b]
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a69cb]
movzx edx, byte [ecx + 0x100a695f]
mov byte [ebp - 6], al
mov al, byte [ebp - 1]
mov byte [ebp - 7], dl
mov dl, bl
sub bl, al
xor dl, al
movzx eax, bl
movzx edi, dl
add di, word [ebp - 0x10]
mov dl, byte [ebp - 3]
xor di, ax
mov al, byte [ebp - 2]
mov bl, al
xor bl, dl
sub al, dl
movzx ebx, bl
add di, bx
movzx edx, al
mov al, byte [ebp - 4]
xor di, dx
mov dl, byte [ebp - 5]
mov bl, al
xor bl, dl
movzx ebx, bl
sub al, dl
mov dl, byte [ebp - 6]
add di, bx
movzx eax, al
xor di, ax
mov al, byte [ebp - 7]
mov bl, dl
xor bl, al
movzx ebx, bl
add di, bx
sub al, dl
add dword [ebp - 0xc], 4
movzx edx, al
xor di, dx
movzx eax, di
mov edi, dword [ebp - 0x14]
add esi, 4
add edi, 4
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp esi, 0x21
jb 0x100077e0
mov edx, dword [0xd227b0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax - 0x3c]
mov byte [0x1013ba3d], cl
lea ecx, [ebp - 0x14]
push ecx
shr eax, 8
sub al, 0x46
push 0x40
mov byte [0x1013ba3c], al
mov eax, dword [0xd227f8]
push 4
push 0xd227b0
mov dword [0x1013ba44], edx
mov dword [0x1013ba40], eax
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227b0], 0x10007700
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227b0
call esi
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 4
push 0xd227f8
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227f8], 0x10007760
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227f8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b8a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf8], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebfe], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee42], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee48], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
mov byte [0x62eeeb], bl
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
mov bl, 0x69
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf7], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee41], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee4], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee4
call esi
push 0x1000baa0
push 0x520ecf
mov bl, 0xe8
call fcn.10016440
push 0x1000baa0
push 0x520f1f
call fcn.10016440
push 0x1000baa0
push 0x63e743
call fcn.10016440
push 0x1000baa0
push 0x640eb2
call fcn.10016440
push 0x1000baa0
push 0x7d2dd9
call fcn.10016440
push 0x1000baa0
push 0x7e6c0f
call fcn.10016440
push 0x1000baa0
push 0x84aef7
call fcn.10016440
push 0x1000baf0
push 0x47fe12
call fcn.10016440
add esp, 0x40
push 0x1000bb50
push 0x4dada4
call fcn.10016440
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bc20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a6b1b], 0
je 0x1000bcbf
push ebx
push esi
push 0x64
push 0
push 0x1013c098
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x63e7e4
call esi
mov edx, 0x63e7e4
mov ecx, 0x90909090
lea eax, [ebp - 4]
push eax
mov word [edx], cx
mov ecx, dword [ebp - 4]
push ecx
push 2
push edx
call esi
push 0x1000bcd0
push 0x62eb26
or bl, 0xff
call fcn.10016440
push 0x1000bce0
push 0x888d5f
mov bl, 0xe8
call fcn.10016440
push 0x1000bda0
push 0x886cd7
or bl, 0xff
call fcn.10016440
push 0x1000bda0
push 0x7d3cbd
or bl, 0xff
call fcn.10016440
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000bdd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b85
call esi
mov bl, 0xff
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b85], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b85
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b86
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b86], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b86
call esi
push 0x1000bf00
push 0x4e199d
mov bl, 0xe8
call fcn.10016440
push 0x1000bf00
push 0x587049
call fcn.10016440
push 0x1000bf00
push 0x590ccc
call fcn.10016440
push 0x1000bf00
push 0x5bbee6
call fcn.10016440
push 0x1000bf00
push 0x64229d
call fcn.10016440
push 0x1000bf00
push 0x642d51
call fcn.10016440
push 0x1000bf00
push 0x643229
call fcn.10016440
push 0x1000bf00
push 0x65ea86
call fcn.10016440
add esp, 0x40
push 0x1000bf00
push 0x911a53
call fcn.10016440
push 0x1000bf00
push 0x911a6d
call fcn.10016440
push 0x1000bf00
push 0x911a87
call fcn.10016440
push 0x1000bf00
push 0x911aa1
call fcn.10016440
push 0x1000bf00
push 0x911abb
call fcn.10016440
add esp, 0x28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
fld dword [0x10143a44]
sub esp, 0x10
call fcn.10018120
fld dword [0x10143a48]
push 0xa
add eax, 0x14
push 0xa
push eax
call fcn.10018120
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000e168
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000e168
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x10143a58], 1
je 0x1000e115
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x10], 0x90909090
mov dword [ebp - 0xc], 0x90909090
mov word [ebp - 8], 0x9090
call esi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, 0x4d9a02
mov dword [eax], edx
mov dx, word [ebp - 8]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 0xa
push 0x4d9a02
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x10], 0x17e8006a
mov dword [ebp - 0xc], 0x8300102e
mov word [ebp - 8], 0x4c4
call esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, 0x4d9a02
mov dword [eax], ecx
mov cx, word [ebp - 8]
mov dword [eax + 4], edx
lea edx, [ebp - 4]
push edx
mov word [eax + 8], cx
mov eax, dword [ebp - 4]
push eax
push 0xa
push 0x4d9a02
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x1000e380
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x10143a44]
call fcn.10018120
fld dword [0x10143a48]
push 0xa
add eax, 0x64
push 0xa
push eax
call fcn.10018120
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000e477
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000e477
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x10143a68], 1
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x74cd30
je 0x1000e42f
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x74cd30], 0xc3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x74cd30
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x771310
call esi
mov byte [0x771310], 0xc3
jmp 0x1000e45f
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x74cd30], 0x55
mov eax, dword [ebp - 4]
push eax
push 1
push 0x74cd30
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x771310
call esi
mov byte [0x771310], 0x55
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push 1
push 0x771310
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret