joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c0c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
push 0x4c
call fcn.100ea11b
add esp, 4
test eax, eax
je 0x1003c0f7
push 0x10007540
push 0x1003c250
push 6
lea esi, [eax + 4]
mov dword [eax], 6
push 0xc
push esi
call fcn.100ea219
mov dword [0x1015586c], esi
jmp 0x1003c101
mov dword [0x1015586c], 0
sub esp, 0x28
mov ecx, 0x1003bcb0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x1003c126
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x1003bcb0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154db8
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1003c16f
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2108
call esi
mov eax, 0x1003c0a0
mov byte [0x4a2108], 0xe9
sub eax, 0x4a210d
mov dword [0x4a2109], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2108
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2094
call esi
mov eax, 0x1003c0b0
mov byte [0x4a2094], 0xe9
sub eax, 0x4a2099
mov dword [0x4a2095], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2094
call esi
pop esi
add esp, 0x10
ret

Function at 0x1003ccd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a281c
call esi
mov eax, 0x1003cc90
mov byte [0x4a281c], 0xe9
sub eax, 0x4a2821
mov dword [0x4a281d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a281c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a258c
call esi
mov eax, 0x1003cca0
mov byte [0x4a258c], 0xe9
sub eax, 0x4a2591
mov dword [0x4a258d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a258c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2790
call esi
mov eax, 0x1003ccb0
mov byte [0x4a2790], 0xe9
sub eax, 0x4a2795
mov dword [0x4a2791], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2790
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a26d0
call esi
mov eax, 0x1003ccc0
mov byte [0x4a26d0], 0xe9
sub eax, 0x4a26d5
mov dword [0x4a26d1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a26d0
call esi
pop esi
pop ecx
ret
Function at 0x1003d030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c8f4c
call esi
mov eax, 0x1003d010
mov byte [0x4c8f4c], 0xe9
sub eax, 0x4c8f51
mov dword [0x4c8f4d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c8f4c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443ef4
call esi
mov eax, 0x1003cf90
sub eax, 0x443ef8
mov dword [0x443ef4], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x443ef4
call esi
pop esi
pop ecx
ret

Function at 0x1003d0b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 0x21
push 0x101558d0
push 0x10122374
mov edx, str.ScreenShot
mov ecx, 0x1011f8fc
call fcn.1000dde0
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4c9048
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1003d020
mov byte [0x4c9048], 0xe9
sub eax, 0x4c904d
mov dword [0x4c9049], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4c9048
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x1003dd30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447614
call esi
mov eax, 0x1003dfb0
mov byte [0x447614], 0xe9
sub eax, 0x447619
mov dword [0x447615], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447614
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4458bc
call esi
mov eax, 0x1003dd20
mov byte [0x4458bc], 0xe9
sub eax, 0x4458c1
mov dword [0x4458bd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4458bc
call esi
pop esi
pop ecx
ret

Function at 0x1003ddb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5186fc]
push ebx
push esi
push edi
test eax, eax
je 0x1003ddc6
movzx edi, word [eax + 8]
jmp 0x1003ddc9
or edi, 0xffffffff
mov eax, dword [0x1013cc58]
cmp edi, dword [eax]
jle 0x1003de44
push str._n_Waiting_for_fidget_to_complete...
call fcn.10016d20
mov eax, dword [0x1013cc58]
add esp, 4
cmp edi, dword [eax]
jle 0x1003de44
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
call fcn.1003b980
mov eax, dword [0x1013cc5c]
mov esi, dword [eax]
call ebx
mov edx, eax
mov ecx, eax
sub edx, esi
sub ecx, esi
cmp eax, esi
mov eax, 0x596c34
cmovae ecx, edx
cmp ecx, dword [eax]
jb 0x1003de3b
mov edx, dword [0x1013cc58]
mov eax, 0x5186fc
mov edx, dword [edx]
mov ecx, dword [eax]
call fcn.1005c110
call ebx
mov ecx, dword [0x1013cc5c]
mov dword [ecx], eax
mov eax, dword [0x1013cc58]
inc dword [eax]
jmp 0x1003de40
mov eax, dword [0x1013cc58]
cmp edi, dword [eax]
jg 0x1003ddf0
mov dword [eax], 0
mov eax, dword [0x5186f8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call dword [0x10120e98]
cmp eax, 0xffffffff
jne 0x1003de6d
push str._n_Error_unlocking_fidget_on_transition...
call fcn.10016d20
add esp, 4
pop edi
pop esi
mov dword [0x5186fc], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003de80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5186fc], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0xc], ebx
je 0x1003dfa2
cmp dword [0x518744], 0xffffffff
je 0x1003dfa2
call dword [0x10121424]
push str._nStarting_transition...
call fcn.10016d20
add esp, 4
call fcn.1003ddb0
mov eax, dword [0x518850]
movzx ecx, bl
and eax, 0xfff
or ecx, 0x800
shl ecx, 0x10
or ecx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call dword [0x10120ea0]
mov ebx, eax
test ebx, ebx
jne 0x1003df07
push str._n_Error_locking_transition...
call fcn.10016d20
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov dword [0x1016eaf8], eax
movzx eax, word [ebx + 4]
movsx ecx, ax
test ax, ax
jne 0x1003df20
mov ecx, 0xa
mov eax, 0x2ee
xor edi, edi
cdq
xor esi, esi
idiv ecx
mov dword [ebp - 0xc], eax
movzx eax, word [ebx + 8]
mov dword [ebp - 8], eax
test eax, eax
jle 0x1003df74
nop word [eax + eax]
call fcn.1003b980
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov ecx, eax
sub edx, edi
sub ecx, edi
cmp eax, edi
cmovae ecx, edx
cmp ecx, dword [ebp - 0xc]
jb 0x1003df6f
mov edx, esi
mov ecx, ebx
call fcn.1005c110
inc esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp esi, dword [ebp - 8]
jl 0x1003df40
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call dword [0x10120e98]
cmp eax, 0xffffffff
jne 0x1003df95
push str._n_Error_unlocking_transition...
call fcn.10016d20
add esp, 4
push str._nFinished_transition...
call fcn.10016d20
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e4a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca534
call esi
mov eax, 0x1003e470
mov byte [0x4ca534], 0xe9
sub eax, 0x4ca539
mov dword [0x4ca535], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca534
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca34c
call esi
mov eax, 0x1003e480
mov byte [0x4ca34c], 0xe9
sub eax, 0x4ca351
mov dword [0x4ca34d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca34c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ca0ac
call esi
mov eax, 0x1003e490
mov byte [0x4ca0ac], 0xe9
sub eax, 0x4ca0b1
mov dword [0x4ca0ad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ca0ac
call esi
pop esi
pop ecx
ret
Function at 0x10040fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [ecx + 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
push edi
test esi, esi
je 0x1004116d
mov eax, dword [esi + 0x78]
test eax, eax
je 0x10040fda
mov esi, eax
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x10040fd1
mov dword [esp + 0x2c], 0x10016cc0
mov edx, dword [esi + 4]
and edx, 0x2000000
mov dword [esp + 0x28], edx
cmp edx, dword [esp + 0x44]
jne 0x10041162
mov edi, dword [esi + 0x48]
test edi, edi
je 0x10041162
movups xmm0, xmmword [esi + 8]
mov ebx, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
movd eax, xmm0
movups xmmword [esp + 0x30], xmm0
add dword [esp + 0x34], ebp
add dword [esp + 0x38], ebx
add eax, ebx
add dword [esp + 0x3c], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10041070
lea ecx, [esp + 0x30]
mov edx, eax
push ecx
call fcn.1003b910
cmp eax, 0xffffffff
je 0x1004115e
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
sub ecx, ebx
mov dword [esp + 0x20], eax
sub eax, ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
sub eax, ebp
sub ebx, ebp
jmp 0x10041080
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x30]
cmp edi, eax
jne 0x10041097
test dword [esi + 4], 0x20000
je 0x10041097
mov edi, dword [esi + 0x34]
test byte [esi + 4], 8
je 0x100410ba
cmp edi, eax
jne 0x100410a6
mov edi, dword [esi + 0x3c]
jmp 0x100410d5
cmp edi, dword [esi + 0x34]
jne 0x100410b0
mov edi, dword [esi + 0x40]
jmp 0x100410d5
cmp edi, dword [esi + 0x38]
jne 0x100410d5
mov edi, dword [esi + 0x44]
jmp 0x100410d5
cmp edi, dword [esi + 0x3c]
jne 0x100410c3
mov edi, eax
jmp 0x100410d5
cmp edi, dword [esi + 0x40]
jne 0x100410cd
mov edi, dword [esi + 0x34]
jmp 0x100410d5
cmp edi, dword [esi + 0x44]
jne 0x100410d5
mov edi, dword [esi + 0x38]
test edi, edi
je 0x1004115e
sub ecx, dword [esp + 0x10]
mov eax, 0x10016cb0
mov ebp, dword [esi + 0x10]
inc ecx
sub ebp, dword [esi + 8]
mov dword [esp + 0x24], ecx
inc ebp
mov ecx, dword [esp + 0x18]
sub ebx, ecx
sub ecx, dword [esi + 0xc]
inc ebx
imul ecx, ebp
sub ecx, dword [esi + 8]
add ecx, dword [esp + 0x10]
add ecx, edi
test byte [esi + 4], 0x20
cmovne eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
test edx, edx
je 0x10041138
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x1004115b
mov eax, dword [0x1013cf04]
push eax
imul eax, dword [esp + 0x38]
add eax, dword [0x51e3fc]
add eax, dword [esp + 0x24]
jmp 0x1004114c
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
push eax
imul eax, dword [esp + 0x1c]
add eax, dword [edx + 0x2c]
add eax, dword [esp + 0x14]
push eax
push ebp
push ebx
push dword [esp + 0x34]
push ecx
call dword [esp + 0x40]
add esp, 0x18
mov dword [esi + 0x48], edi
mov ecx, dword [esp + 0x14]
mov esi, dword [esi + 0x74]
test esi, esi
jne 0x10040fe2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x1006ffa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 0
mov edx, str.DeathScreenFontPatch
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
mov edx, str.SpecialDeathGVAR
push 0x1eb
mov ecx, str.Misc
setne byte [0x10175031]
call fcn.1000dcb0
mov dword [0x1013ced8], eax
lea eax, [esp]
push eax
push 0x40
push 5
push 0x440bd0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1006ff90
mov byte [0x440bd0], 0xe9
sub eax, 0x440bd5
mov dword [0x440bd1], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x440bd0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10070d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4bc6f0
call esi
mov eax, 0x10070d70
mov byte [0x4bc6f0], 0xe9
sub eax, 0x4bc6f5
mov dword [0x4bc6f1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4bc6f0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447fa0
call esi
mov eax, 0x10070d80
mov byte [0x447fa0], 0xe9
sub eax, 0x447fa5
mov dword [0x447fa1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447fa0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43186c
call esi
mov eax, 0x10070cf0
mov byte [0x43186c], 0xe9
sub eax, 0x431871
mov dword [0x43186d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43186c
call esi
pop esi
pop ecx
ret

Function at 0x10071440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push 0
mov edx, str.DisableSpecialMapIDs
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
je 0x100714b5
cmp byte [0x10174f84], 0
je 0x100714a1
test byte [0x10174f88], 1
je 0x100714a1
mov edx, str.Applying_disable_handling_special_maps_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100714a1
mov edx, str.Applying_disable_handling_special_maps_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov dword [0x1013cee0], 0xffffffff
mov dword [0x1013cedc], 0xffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48411c
call esi
mov eax, 0x10071420
mov byte [0x48411c], 0xe9
sub eax, 0x484121
mov dword [0x48411d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48411c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x482158
call esi
mov eax, 0x10071430
mov byte [0x482158], 0xe9
sub eax, 0x48215d
mov dword [0x482159], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x482158
call esi
pop esi
pop ecx
ret
Function at 0x10071fa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x415efc
call esi
mov eax, 0x10071f70
mov byte [0x415efc], 0xe9
sub eax, 0x415f01
mov dword [0x415efd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x415efc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4163c8
call esi
mov eax, 0x10071f90
mov byte [0x4163c8], 0xe9
sub eax, 0x4163cd
mov dword [0x4163c9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4163c8
call esi
mov eax, dword [0x10153db4]
sub eax, dword [0x10153dac]
sar eax, 4
pop esi
cmp eax, 0x9c40
jae 0x10072038
push 0x9c40
call fcn.10072140
push dword [0x1013cee4]
call fcn.10072050
pop ecx
ret

Function at 0x10072ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49d4d4
call esi
mov eax, 0x10072c60
mov byte [0x49d4d4], 0xe9
sub eax, 0x49d4d9
mov dword [0x49d4d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49d4d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44cec4
call esi
mov eax, 0x10072c70
mov byte [0x44cec4], 0xe9
sub eax, 0x44cec9
mov dword [0x44cec5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44cec4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48a568
call esi
mov eax, 0x10072c80
mov byte [0x48a568], 0xe9
sub eax, 0x48a56d
mov dword [0x48a569], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48a568
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48d8e8
call esi
mov eax, 0x10072c90
mov byte [0x48d8e8], 0xe9
sub eax, 0x48d8ed
mov dword [0x48d8e9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48d8e8
call esi
pop esi
pop ecx
ret

Function at 0x100730c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1754
call esi
mov eax, 0x10073090
mov byte [0x4b1754], 0xe9
sub eax, 0x4b1759
mov dword [0x4b1755], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1754
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b185c
call esi
mov eax, 0x100730a0
mov byte [0x4b185c], 0xe9
sub eax, 0x4b1861
mov dword [0x4b185d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b185c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1a6c
call esi
mov eax, 0x100730b0
mov byte [0x4b1a6c], 0xe9
sub eax, 0x4b1a71
mov dword [0x4b1a6d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1a6c
call esi
pop esi
pop ecx
ret
Function at 0x10073e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10071440
call fcn.10072ca0
call fcn.100730c0
call fcn.10071fa0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48b848
call esi
mov eax, 0x10073e10
mov byte [0x48b848], 0xe9
sub eax, 0x48b84d
mov dword [0x48b849], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48b848
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48b930
call esi
mov eax, 0x10073e20
mov byte [0x48b930], 0xe9
sub eax, 0x48b935
mov dword [0x48b931], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48b930
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1b84
call esi
mov eax, 0x10073e30
mov byte [0x4b1b84], 0xe9
sub eax, 0x4b1b89
mov dword [0x4b1b85], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1b84
call esi
pop esi
pop ecx
ret

Function at 0x100741d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10074120
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3338
call esi
mov eax, 0x10074190
mov byte [0x4a3338], 0xe9
sub eax, 0x4a333d
mov dword [0x4a3339], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3338
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a34cc
call esi
mov eax, 0x100741a0
mov byte [0x4a34cc], 0xe9
sub eax, 0x4a34d1
mov dword [0x4a34cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a34cc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3518
call esi
mov eax, 0x100741b0
mov byte [0x4a3518], 0xe9
sub eax, 0x4a351d
mov dword [0x4a3519], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3518
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a347c
call esi
mov eax, 0x100741c0
mov byte [0x4a347c], 0xe9
sub eax, 0x4a3481
mov dword [0x4a347d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a347c
call esi
pop esi
pop ecx
ret

Function at 0x100745a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100741d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3d84
call esi
mov eax, 0x10074570
mov byte [0x4a3d84], 0xe9
sub eax, 0x4a3d89
mov dword [0x4a3d85], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3d84
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2834
call esi
mov eax, 0x10074580
mov byte [0x4a2834], 0xe9
sub eax, 0x4a2839
mov dword [0x4a2835], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2834
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3620
call esi
mov eax, 0x10074590
mov byte [0x4a3620], 0xe9
sub eax, 0x4a3625
mov dword [0x4a3621], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3620
call esi
pop esi
pop ecx
ret
Function at 0x100751e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
movaps xmm0, xmmword [0x101329d0]
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4d9808
movups xmmword [0x10142cb8], xmm0
mov dword [0x10142cc8], 0x7feb
mov dword [0x10142ccc], 0x7c00
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100751d0
mov byte [0x4d9808], 0xe9
sub eax, 0x4d980d
mov dword [0x4d9809], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4d9808
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10075d10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100751e0
call fcn.10076370
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6dac
call esi
mov eax, 0x10075cb0
mov byte [0x4d6dac], 0xe9
sub eax, 0x4d6db1
mov dword [0x4d6dad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6dac
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6e64
call esi
mov eax, 0x10075cc0
mov byte [0x4d6e64], 0xe9
sub eax, 0x4d6e69
mov dword [0x4d6e65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6e64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6ea0
call esi
mov eax, 0x10075cd0
mov byte [0x4d6ea0], 0xe9
sub eax, 0x4d6ea5
mov dword [0x4d6ea1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6ea0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d765c
call esi
mov eax, 0x10075ce0
mov byte [0x4d765c], 0xe9
sub eax, 0x4d7661
mov dword [0x4d765d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d765c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6238
call esi
mov eax, 0x10075cf0
mov byte [0x4d6238], 0xe9
sub eax, 0x4d623d
mov dword [0x4d6239], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6238
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6468
call esi
mov eax, 0x10075d00
mov byte [0x4d6468], 0xe9
sub eax, 0x4d646d
mov dword [0x4d6469], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6468
call esi
pop esi
pop ecx
ret