joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11020eb0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x11020f1f
cmp dword [ecx], edi
jne 0x11020f17
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x11020f27
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x11020f27
cmp dword [ecx], edi
jne 0x11020f2b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
push dword [edi + 0xc]
call fcn.1107e309
add esp, 4
mov edx, 1
mov ecx, edi
push 0x18
call fcn.11004ac0
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x110210d0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x110e4544]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x110e4550]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x110e453c]
cmp edi, edx
jne 0x11021130
mov ecx, edx
jmp 0x11021135
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1102115a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x11021144
mov eax, dword [eax]
jmp 0x11021128
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8
Function at 0x11021310
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1109e670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x11021391
mov esi, dword [ebx + 4]
jmp 0x11021397
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x110213ac
mov ecx, dword [edi]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x110213f3
cmp esi, eax
jne 0x110213a0
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x110213dc
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1102143d
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1102145f
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
push dword [edi + 0xc]
call fcn.1107e309
add esp, 4
mov edx, 1
mov ecx, edi
push 0x18
call fcn.11004ac0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x11021445
mov dword [ecx], edi
jmp 0x1102145f
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1102145f
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.110214b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x11021c60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x18
mov byte [0x110c674f], 1
cmp byte [0x110c6683], 0
push esi
je 0x11021c8e
test byte [0x110c66ec], 1
je 0x11021c8e
push 0
mov edx, 1
mov ecx, str.Applying_expanded_action_points_bar_patch.
call fcn.11011060
mov eax, dword [0x110c6744]
test eax, eax
je 0x11021d40
cmp byte [0x110c673b], 0
je 0x11021d10
add eax, 0x39358
push str.HR_IFACE__i.frm
push eax
call fcn.1108b490
add esp, 8
test eax, eax
jne 0x11021d10
mov ecx, dword [0x110c6744]
mov edx, str.E.frm
lea ecx, [ecx + 0x39363]
call fcn.1100fc50
sub esp, 0x28
mov ecx, 0x11021c50
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x11021cf6
mov dword [eax], 0x110b3d0c
mov dword [eax + 4], 0x11021c50
mov dword [eax + 0x24], eax
lea eax, [esp + 0x2c]
mov ecx, 0x110e5100
push eax
call fcn.110053e0
lea ecx, [esp + 4]
call fcn.110052a0
jmp 0x11021d4c
cmp byte [0x110c6683], 0
je 0x11021e77
test byte [0x110c66ec], 1
je 0x11021e77
mov ecx, str._Incorrect_HRP_version_
mov edx, 1
push 1
call fcn.11011060
pop esi
add esp, 0x18
ret
mov eax, dword [0x110c0a0c]
add dword [eax], 0xffffffe5
add dword [eax + 8], 0x1b
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x45e343
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x45ee3f
mov ecx, 0x110e6d80
call fcn.1100f980
lea eax, [esp + 0x18]
mov dword [esp + 4], 0x45ee55
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x45ee7b
mov cl, 0x10
mov dword [esp + 0x10], 0x45ee82
mov dword [esp + 0x14], 0x45ee9c
mov dword [esp + 0x18], 0x45eea0
call fcn.1101e0e0
lea eax, [esp + 0x10]
mov dword [esp + 4], 0x45ee33
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x45eec8
mov ecx, 0x2421
mov dword [esp + 0x10], 0x45ef16
call fcn.1100f980
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x45d919
call esi
mov eax, 0x11021c00
sub eax, 0x45d91d
mov dword [0x45d919], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x45d919
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45e356
call esi
mov eax, 0x11021c20
mov byte [0x45e356], 0xe8
sub eax, 0x45e35b
mov dword [0x45e357], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45e356
call esi
push 1
push 0x11021c40
mov edx, 0x45ee38
mov cl, 0xe9
call fcn.1100fb30
cmp byte [0x110c6683], 0
je 0x11021e77
test byte [0x110c66ec], 1
je 0x11021e77
mov ecx, str._Done
mov edx, 1
push 1
call fcn.11011060
pop esi
add esp, 0x18
ret
Function at 0x11021ee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4604b0
call esi
mov eax, 0x11021e80
mov byte [0x4604b0], 0xe8
sub eax, 0x4604b5
mov dword [0x4604b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4604b0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x460504
call esi
mov eax, 0x11021ec0
mov byte [0x460504], 0xe8
sub eax, 0x460509
mov dword [0x460505], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x460504
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x4604d4
call esi
mov eax, 0x9052
mov word [0x4604d4], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x4604d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x46034b
call esi
lea eax, [esp + 4]
mov byte [0x46034b], 0x14
push eax
push dword [esp + 8]
push 1
push 0x46034b
call esi
pop esi
pop ecx
ret
Function at 0x110237a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110237ea
lea ecx, [esp + 8]
push ecx
push str.SpeedInterfaceCounterAnims
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110237ea
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x110237e3
mov ecx, dword [ecx]
call fcn.11011f90
jmp 0x110237ec
xor eax, eax
sub eax, 1
je 0x11023851
sub eax, 1
jne 0x110238b2
cmp byte [0x110c6683], al
je 0x1102381a
test byte [0x110c66ec], 1
je 0x1102381a
push 1
lea edx, [eax + 1]
mov ecx, str.Applying_SpeedInterfaceCounterAnims_patch__Instant_.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x460bb6
call esi
lea eax, [esp + 8]
mov dword [0x460bb6], 0xdb319090
push eax
push dword [esp + 0xc]
push 4
push 0x460bb6
call esi
pop esi
add esp, 8
ret
cmp byte [0x110c6683], 0
je 0x11023874
test byte [0x110c66ec], 1
je 0x11023874
push 1
mov edx, 1
mov ecx, str.Applying_SpeedInterfaceCounterAnims_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x460ba1
call esi
mov eax, 0x11023780
mov byte [0x460ba1], 0xe9
sub eax, 0x460ba6
mov dword [0x460ba2], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x460ba1
call esi
pop esi
add esp, 8
ret
Function at 0x11023fd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110240be
lea ecx, [esp + 0x10]
push ecx
push str.CombatPanelAnimDelay
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110240be
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x11024027
mov ecx, dword [ecx]
call fcn.11011f90
mov ebx, eax
mov eax, 0x3e8
cmp bx, ax
je 0x110240ae
movzx ecx, bx
lea eax, [esp + 0x18]
push ecx
push str.CombatPanelAnimDelay
push str.Applying_patch:__s___d.
push 0xffffffffffffffff
push 0xff
push eax
call fcn.110243f0
add esp, 0x18
cmp byte [0x110c6683], 0
je 0x1102407c
test byte [0x110c66ec], 1
je 0x1102407c
push 1
mov edx, 1
lea ecx, [esp + 0x1c]
call fcn.11011060
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
mov esi, dword [esi + edi*4]
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push esi
call ebp
lea eax, [esp + 0x10]
mov word [esi], bx
push eax
push dword [esp + 0x14]
push 2
push esi
call ebp
mov esi, dword [esp + 0x14]
inc edi
cmp edi, 2
jl 0x11024084
mov ax, bx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0x14
pop edi
pop esi
pop ebp
mov eax, 0x3e8
pop ebx
add esp, 0x108
ret 0x14

Function at 0x110240d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
mov esi, dword [esp + 0x120]
test eax, eax
je 0x1102412e
lea ecx, [esp + 0x10]
push ecx
push esi
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x1102412e
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x1102411e
mov ecx, dword [ecx]
call fcn.11011f90
mov ebx, eax
mov al, byte [esp + 0x124]
jmp 0x11024138
mov al, byte [esp + 0x124]
movzx ebx, al
cmp bl, al
je 0x110241dc
movzx ecx, byte [esp + 0x12c]
cmp bl, byte [esp + 0x12c]
movzx edx, bl
cmova edx, ecx
movzx eax, dl
push eax
push esi
push str.Applying_patch:__s___d.
push 0xffffffffffffffff
lea eax, [esp + 0x28]
mov dword [esp + 0x20], edx
push 0xff
push eax
call fcn.110243f0
add esp, 0x18
cmp byte [0x110c6683], 0
je 0x11024199
test byte [0x110c66ec], 1
je 0x11024199
push 1
mov edx, 1
lea ecx, [esp + 0x1c]
call fcn.11011060
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
mov esi, dword [ebp + edi*4]
lea eax, [esp + 0x14]
push eax
push 0x40
push 1
push esi
call ebx
mov eax, dword [esp + 0x10]
mov byte [esi], al
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 1
push esi
call ebx
inc edi
cmp edi, 2
jl 0x110241a1
mov al, byte [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0x14
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x108
ret 0x14
Function at 0x11024270
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
mov esi, dword [esp + 0x124]
mov edi, dword [esp + 0x120]
test eax, eax
je 0x110242ce
lea ecx, [esp + 0x14]
push ecx
push edi
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110242ce
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x14], 0x10
jb 0x110242c5
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x110242d0
mov ecx, esi
cmp ecx, esi
je 0x11024365
mov ebx, dword [esp + 0x128]
cmp ecx, ebx
jb 0x110242f4
cmp ecx, dword [esp + 0x12c]
mov ebx, ecx
cmova ebx, dword [esp + 0x12c]
push ebx
push edi
push str.Applying_patch:__s___d.
push 0xffffffffffffffff
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.110243f0
add esp, 0x18
cmp byte [0x110c6683], 0
je 0x11024331
test byte [0x110c66ec], 1
je 0x11024331
push 1
mov edx, 1
lea ecx, [esp + 0x1c]
call fcn.11011060
mov edi, dword [ebp]
lea eax, [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [esp + 0x14]
mov dword [edi], ebx
push eax
push dword [esp + 0x18]
push 4
push edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0x14
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x108
ret 0x14
Function at 0x11026220
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1109e740
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x110262a1
mov esi, dword [ebx + 4]
jmp 0x110262a7
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x110262bc
mov ecx, dword [edi]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x11026303
cmp esi, eax
jne 0x110262b0
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x110262ec
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x11026340
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x11026362
mov ecx, dword [ebp + 0x10]
push 0x10
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [edx], eax
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, 1
dec dword [ebx + 8]
call fcn.11004ac0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x11026348
mov dword [ecx], edi
jmp 0x11026362
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x11026362
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.110263b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110289b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x14
cmp byte [0x110c6683], 0
je 0x110289d6
test byte [0x110c66ec], 1
je 0x110289d6
push 1
mov edx, 1
mov ecx, str.Applying_additional_weapon_animations_patch.
call fcn.11011060
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x419320
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
mov byte [0x419320], 0x12
push eax
push dword [esp + 8]
push 1
push 0x419320
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x451648
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x451671
push eax
push ecx
mov ecx, 0x11028270
mov dword [esp + 0x18], 0x4194cc
call fcn.1100fcf0
add esp, 0x14
ret
Function at 0x11028db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028dfa
lea ecx, [esp + 8]
push ecx
push str.ScienceOnCritters
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028dfa
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028df3
mov ecx, dword [ecx]
call fcn.11011f90
jmp 0x11028dfc
xor eax, eax
sub eax, 1
je 0x11028e3a
sub eax, 1
jne 0x11028e71
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x41276a
call esi
lea eax, [esp + 8]
mov byte [0x41276a], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x41276a
call esi
pop esi
add esp, 8
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x41276f
call esi
mov eax, 0x110282f0
sub eax, 0x412773
mov dword [0x41276f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x41276f
call esi
pop esi
add esp, 8
ret

Function at 0x11028e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x20
push esi
mov dword [esp + 8], 0x4a50c2
mov dword [esp + 0xc], 0x4a5169
mov dword [esp + 0x10], 0x4a52fa
mov dword [esp + 0x14], 0x4a5302
mov dword [esp + 0x18], 0x4a6b86
mov dword [esp + 0x1c], 0x4a6be0
mov dword [esp + 0x20], 0x4a6c37
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028fe3
lea ecx, [esp + 4]
push ecx
push str.BoostScriptDialogLimit
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028fe3
mov ecx, dword [esp + 4]
cmp dword [ecx + 0x14], 0x10
jb 0x11028f03
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11028fe3
cmp byte [0x110c6683], 0
je 0x11028f33
test byte [0x110c66ec], 1
je 0x11028f33
push 1
mov edx, 1
mov ecx, str.Applying_script_dialog_limit_patch.
call fcn.11011060
push 0x13880
call fcn.1107e661
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [0x110c67d4], eax
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4a50e3
call esi
lea eax, [esp + 4]
mov dword [0x4a50e3], 0x2710
push eax
push dword [esp + 8]
push 4
push 0x4a50e3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4a519f
call esi
lea eax, [esp + 4]
mov dword [0x4a519f], 0x2710
push eax
push dword [esp + 8]
push 4
push 0x4a519f
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4a534f
call esi
lea eax, [esp + 4]
mov dword [0x4a534f], 0x13880
push eax
push dword [esp + 8]
push 4
push 0x4a534f
call esi
mov ecx, dword [0x110c67d4]
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0xc]
call fcn.1100f980
pop esi
add esp, 0x20
ret
Function at 0x11028ff0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110291d4
lea ecx, [esp + 8]
push ecx
push str.NumbersInDialogue
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110291d4
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x1102903b
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x110291d4
cmp byte [0x110c6683], 0
je 0x1102906b
test byte [0x110c66ec], 1
je 0x1102906b
push 1
mov edx, 1
mov ecx, str.Applying_numbers_in_dialogue_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x502c32
call esi
lea eax, [esp + 8]
mov dword [0x502c32], 0x2000202e
push eax
push dword [esp + 0xc]
push 4
push 0x502c32
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x446f3b
call esi
lea eax, [esp + 8]
mov byte [0x446f3b], 0x35
push eax
push dword [esp + 0xc]
push 1
push 0x446f3b
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x5029e2
call esi
lea eax, [esp + 8]
mov dword [0x5029e2], 0x7325202e
push eax
push dword [esp + 0xc]
push 4
push 0x5029e2
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x446f03
call esi
lea eax, [esp + 8]
mov dword [0x446f03], 0x2424448b
push eax
push dword [esp + 0xc]
push 4
push 0x446f03
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x446f07
call esi
lea eax, [esp + 8]
mov byte [0x446f07], 0x50
push eax
push dword [esp + 0xc]
push 1
push 0x446f07
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x446fe0
call esi
lea eax, [esp + 8]
mov dword [0x446fe0], 0x2824448b
push eax
push dword [esp + 0xc]
push 4
push 0x446fe0
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x446fe4
call esi
lea eax, [esp + 8]
mov byte [0x446fe4], 0x50
push eax
push dword [esp + 0xc]
push 1
push 0x446fe4
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4458f5
call esi
mov eax, 0x110282d0
mov byte [0x4458f5], 0xe9
sub eax, 0x4458fa
mov dword [0x4458f6], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4458f5
call esi
pop esi
add esp, 8
ret