joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11039064
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x110e7fec]
push ebx
push esi
mov dword [0x110c0b48], ecx
lea esi, [ecx + ecx*2]
push edi
mov edi, dword [ebp + 8]
sub ecx, 5
mov dword [eax + esi*4 + 4], edi
mov eax, dword [0x110e7ff0]
push 0xffffffffffffffff
lea esi, [ecx + ecx*2]
shl esi, 3
push edx
push 0x14
mov byte [esi + eax], 1
mov eax, dword [0x110e7ff0]
add eax, 4
add eax, esi
push eax
call fcn.11089e9c
add edi, 0xfffffffe
add esp, 0x10
cmp edi, 5
ja case.default.0x1103905d
jmp dword [edi*4 + 0x11039160]
mov eax, 0x6ab8cf
jmp 0x11039093
mov eax, 0x6ab8bb
jmp 0x11039093
mov eax, dword [0x110c0a04]
jmp 0x11039093
mov eax, 0x6a38ef
jmp 0x11039093
mov eax, 0x6ab4ef
jmp 0x11039093
mov eax, 0x6ab6bf
jmp 0x11039093
mov eax, 0x6a3cb0
mov cl, byte [eax]
mov eax, dword [0x110e7ff0]
mov byte [esi + eax + 1], cl
cmp byte [0x110e6d33], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1103911e
lea eax, [ebp + 8]
mov byte [0x110e6d33], 1
push eax
push 0x40
push 5
push 0x461342
call esi
mov eax, 0x11038ee0
mov byte [0x461342], 0xe8
sub eax, 0x461347
mov dword [0x461343], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461342
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x461243
call esi
mov eax, 0x11038f20
mov byte [0x461243], 0xe9
sub eax, 0x461248
mov dword [0x461244], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461243
call esi
mov ebx, dword [0x110c0b48]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push 0x46140b
inc ebx
call esi
lea eax, [ebp + 8]
mov byte [0x46140b], bl
push eax
push dword [ebp + 8]
push 1
push 0x46140b
call esi
call dword [0x110af144]
call dword [0x110af69c]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1103906b
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x110e7fec]
push ebx
push esi
mov dword [0x110c0b48], ecx
lea esi, [ecx + ecx*2]
push edi
mov edi, dword [ebp + 8]
sub ecx, 5
mov dword [eax + esi*4 + 4], edi
mov eax, dword [0x110e7ff0]
push 0xffffffffffffffff
lea esi, [ecx + ecx*2]
shl esi, 3
push edx
push 0x14
mov byte [esi + eax], 1
mov eax, dword [0x110e7ff0]
add eax, 4
add eax, esi
push eax
call fcn.11089e9c
add edi, 0xfffffffe
add esp, 0x10
cmp edi, 5
ja case.default.0x1103905d
jmp dword [edi*4 + 0x11039160]
mov eax, 0x6ab8cf
jmp 0x11039093
mov eax, 0x6ab8bb
jmp 0x11039093
mov eax, dword [0x110c0a04]
jmp 0x11039093
mov eax, 0x6a38ef
jmp 0x11039093
mov eax, 0x6ab4ef
jmp 0x11039093
mov eax, 0x6ab6bf
jmp 0x11039093
mov eax, 0x6a3cb0
mov cl, byte [eax]
mov eax, dword [0x110e7ff0]
mov byte [esi + eax + 1], cl
cmp byte [0x110e6d33], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1103911e
lea eax, [ebp + 8]
mov byte [0x110e6d33], 1
push eax
push 0x40
push 5
push 0x461342
call esi
mov eax, 0x11038ee0
mov byte [0x461342], 0xe8
sub eax, 0x461347
mov dword [0x461343], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461342
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x461243
call esi
mov eax, 0x11038f20
mov byte [0x461243], 0xe9
sub eax, 0x461248
mov dword [0x461244], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461243
call esi
mov ebx, dword [0x110c0b48]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push 0x46140b
inc ebx
call esi
lea eax, [ebp + 8]
mov byte [0x46140b], bl
push eax
push dword [ebp + 8]
push 1
push 0x46140b
call esi
call dword [0x110af144]
call dword [0x110af69c]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x11039072
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x110e7fec]
push ebx
push esi
mov dword [0x110c0b48], ecx
lea esi, [ecx + ecx*2]
push edi
mov edi, dword [ebp + 8]
sub ecx, 5
mov dword [eax + esi*4 + 4], edi
mov eax, dword [0x110e7ff0]
push 0xffffffffffffffff
lea esi, [ecx + ecx*2]
shl esi, 3
push edx
push 0x14
mov byte [esi + eax], 1
mov eax, dword [0x110e7ff0]
add eax, 4
add eax, esi
push eax
call fcn.11089e9c
add edi, 0xfffffffe
add esp, 0x10
cmp edi, 5
ja case.default.0x1103905d
jmp dword [edi*4 + 0x11039160]
mov eax, 0x6ab8cf
jmp 0x11039093
mov eax, 0x6ab8bb
jmp 0x11039093
mov eax, dword [0x110c0a04]
jmp 0x11039093
mov eax, 0x6a38ef
jmp 0x11039093
mov eax, 0x6ab4ef
jmp 0x11039093
mov eax, 0x6ab6bf
jmp 0x11039093
mov eax, 0x6a3cb0
mov cl, byte [eax]
mov eax, dword [0x110e7ff0]
mov byte [esi + eax + 1], cl
cmp byte [0x110e6d33], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1103911e
lea eax, [ebp + 8]
mov byte [0x110e6d33], 1
push eax
push 0x40
push 5
push 0x461342
call esi
mov eax, 0x11038ee0
mov byte [0x461342], 0xe8
sub eax, 0x461347
mov dword [0x461343], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461342
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x461243
call esi
mov eax, 0x11038f20
mov byte [0x461243], 0xe9
sub eax, 0x461248
mov dword [0x461244], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461243
call esi
mov ebx, dword [0x110c0b48]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push 0x46140b
inc ebx
call esi
lea eax, [ebp + 8]
mov byte [0x46140b], bl
push eax
push dword [ebp + 8]
push 1
push 0x46140b
call esi
call dword [0x110af144]
call dword [0x110af69c]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x11039079
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x110e7fec]
push ebx
push esi
mov dword [0x110c0b48], ecx
lea esi, [ecx + ecx*2]
push edi
mov edi, dword [ebp + 8]
sub ecx, 5
mov dword [eax + esi*4 + 4], edi
mov eax, dword [0x110e7ff0]
push 0xffffffffffffffff
lea esi, [ecx + ecx*2]
shl esi, 3
push edx
push 0x14
mov byte [esi + eax], 1
mov eax, dword [0x110e7ff0]
add eax, 4
add eax, esi
push eax
call fcn.11089e9c
add edi, 0xfffffffe
add esp, 0x10
cmp edi, 5
ja case.default.0x1103905d
jmp dword [edi*4 + 0x11039160]
mov eax, 0x6ab8cf
jmp 0x11039093
mov eax, 0x6ab8bb
jmp 0x11039093
mov eax, dword [0x110c0a04]
jmp 0x11039093
mov eax, 0x6a38ef
jmp 0x11039093
mov eax, 0x6ab4ef
jmp 0x11039093
mov eax, 0x6ab6bf
jmp 0x11039093
mov eax, 0x6a3cb0
mov cl, byte [eax]
mov eax, dword [0x110e7ff0]
mov byte [esi + eax + 1], cl
cmp byte [0x110e6d33], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1103911e
lea eax, [ebp + 8]
mov byte [0x110e6d33], 1
push eax
push 0x40
push 5
push 0x461342
call esi
mov eax, 0x11038ee0
mov byte [0x461342], 0xe8
sub eax, 0x461347
mov dword [0x461343], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461342
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x461243
call esi
mov eax, 0x11038f20
mov byte [0x461243], 0xe9
sub eax, 0x461248
mov dword [0x461244], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461243
call esi
mov ebx, dword [0x110c0b48]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push 0x46140b
inc ebx
call esi
lea eax, [ebp + 8]
mov byte [0x46140b], bl
push eax
push dword [ebp + 8]
push 1
push 0x46140b
call esi
call dword [0x110af144]
call dword [0x110af69c]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x11039080
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x110e7fec]
push ebx
push esi
mov dword [0x110c0b48], ecx
lea esi, [ecx + ecx*2]
push edi
mov edi, dword [ebp + 8]
sub ecx, 5
mov dword [eax + esi*4 + 4], edi
mov eax, dword [0x110e7ff0]
push 0xffffffffffffffff
lea esi, [ecx + ecx*2]
shl esi, 3
push edx
push 0x14
mov byte [esi + eax], 1
mov eax, dword [0x110e7ff0]
add eax, 4
add eax, esi
push eax
call fcn.11089e9c
add edi, 0xfffffffe
add esp, 0x10
cmp edi, 5
ja case.default.0x1103905d
jmp dword [edi*4 + 0x11039160]
mov eax, 0x6ab8cf
jmp 0x11039093
mov eax, 0x6ab8bb
jmp 0x11039093
mov eax, dword [0x110c0a04]
jmp 0x11039093
mov eax, 0x6a38ef
jmp 0x11039093
mov eax, 0x6ab4ef
jmp 0x11039093
mov eax, 0x6ab6bf
jmp 0x11039093
mov eax, 0x6a3cb0
mov cl, byte [eax]
mov eax, dword [0x110e7ff0]
mov byte [esi + eax + 1], cl
cmp byte [0x110e6d33], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1103911e
lea eax, [ebp + 8]
mov byte [0x110e6d33], 1
push eax
push 0x40
push 5
push 0x461342
call esi
mov eax, 0x11038ee0
mov byte [0x461342], 0xe8
sub eax, 0x461347
mov dword [0x461343], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461342
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x461243
call esi
mov eax, 0x11038f20
mov byte [0x461243], 0xe9
sub eax, 0x461248
mov dword [0x461244], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461243
call esi
mov ebx, dword [0x110c0b48]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push 0x46140b
inc ebx
call esi
lea eax, [ebp + 8]
mov byte [0x46140b], bl
push eax
push dword [ebp + 8]
push 1
push 0x46140b
call esi
call dword [0x110af144]
call dword [0x110af69c]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x11039087
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x110e7fec]
push ebx
push esi
mov dword [0x110c0b48], ecx
lea esi, [ecx + ecx*2]
push edi
mov edi, dword [ebp + 8]
sub ecx, 5
mov dword [eax + esi*4 + 4], edi
mov eax, dword [0x110e7ff0]
push 0xffffffffffffffff
lea esi, [ecx + ecx*2]
shl esi, 3
push edx
push 0x14
mov byte [esi + eax], 1
mov eax, dword [0x110e7ff0]
add eax, 4
add eax, esi
push eax
call fcn.11089e9c
add edi, 0xfffffffe
add esp, 0x10
cmp edi, 5
ja case.default.0x1103905d
jmp dword [edi*4 + 0x11039160]
mov eax, 0x6ab8cf
jmp 0x11039093
mov eax, 0x6ab8bb
jmp 0x11039093
mov eax, dword [0x110c0a04]
jmp 0x11039093
mov eax, 0x6a38ef
jmp 0x11039093
mov eax, 0x6ab4ef
jmp 0x11039093
mov eax, 0x6ab6bf
jmp 0x11039093
mov eax, 0x6a3cb0
mov cl, byte [eax]
mov eax, dword [0x110e7ff0]
mov byte [esi + eax + 1], cl
cmp byte [0x110e6d33], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1103911e
lea eax, [ebp + 8]
mov byte [0x110e6d33], 1
push eax
push 0x40
push 5
push 0x461342
call esi
mov eax, 0x11038ee0
mov byte [0x461342], 0xe8
sub eax, 0x461347
mov dword [0x461343], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461342
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x461243
call esi
mov eax, 0x11038f20
mov byte [0x461243], 0xe9
sub eax, 0x461248
mov dword [0x461244], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x461243
call esi
mov ebx, dword [0x110c0b48]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push 0x46140b
inc ebx
call esi
lea eax, [ebp + 8]
mov byte [0x46140b], bl
push eax
push dword [ebp + 8]
push 1
push 0x46140b
call esi
call dword [0x110af144]
call dword [0x110af69c]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x11039180
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov edx, 0x110afb5c
mov ecx, dword [0x110e7fec]
push esi
push edi
push 0x110afb78
lea ecx, [ecx + 8]
call fcn.1100f980
mov esi, dword [0x110e7fec]
lea eax, [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 4
push eax
push 0x40
push 4
push 0x4612fe
call edi
lea eax, [esp + 0x10]
mov dword [0x4612fe], esi
push eax
push dword [esp + 0x14]
push 4
push 0x4612fe
call edi
mov esi, dword [0x110e7fec]
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x46133c
call edi
lea eax, [esp + 0x10]
mov dword [0x46133c], esi
push eax
push dword [esp + 0x14]
push 4
push 0x46133c
call edi
lea ebx, [ebp*2]
add ebx, ebp
shl ebx, 2
cmp byte [0x110fca6d], 0
mov dword [0x110e7fa4], ebx
jne 0x1103928a
lea eax, [esp + 0x10]
push eax
push 0x40
cmp ebp, 0xa
jle 0x11039269
push 5
push 0x461493
call edi
mov eax, 0x11038f40
mov byte [0x461493], 0xe9
sub eax, 0x461498
mov dword [0x461494], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push 0x461493
call edi
pop edi
pop esi
pop ebp
mov byte [0x110fca6d], 1
pop ebx
pop ecx
ret
push 1
push 0x461495
call edi
lea eax, [esp + 0x10]
mov byte [0x461495], bl
push eax
push dword [esp + 0x14]
push 1
push 0x461495
call edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x11039290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [0x6ac9f8]
mov eax, 0x81020409
sub edi, dword [0x6ac9f0]
inc edi
imul edi
add edx, edi
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
inc ebx
add ebx, edx
cmp ebx, 0x10
jle 0x110392c0
mov ebx, 0x10
jmp 0x110392ca
mov eax, 6
cmp ebx, eax
cmovl ebx, eax
cmp ebx, dword [0x110c0b3c]
je 0x11039360
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x461513
mov dword [0x110c0b3c], ebx
call esi
lea eax, [esp + 0xc]
mov byte [0x461513], bl
push eax
push dword [esp + 0x10]
push 1
push 0x461513
call esi
lea eax, [esp + 0xc]
dec ebx
push eax
push 0x40
push 1
push 0x461718
call esi
lea eax, [esp + 0xc]
mov byte [0x461718], bl
push eax
push dword [esp + 0x10]
push 1
push 0x461718
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x46170a
call esi
lea eax, [esp + 0xc]
shl bl, 2
push eax
mov byte [0x46170a], bl
push dword [esp + 0x10]
push 1
push 0x46170a
call esi
pop esi
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x11039e60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x110e4dc8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
mov dword [esp + 0xc], eax
mov edi, ecx
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x14]
push eax
push edi
call ebx
cmp dword [esp + 8], 0
je 0x11039efa
mov eax, dword [0x110e4dc4]
push esi
mov esi, dword [eax]
cmp esi, eax
je 0x11039ec3
lea ebx, [ebx]
mov eax, dword [esi + 8]
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push edi
call ebx
mov esi, dword [esi]
mov eax, dword [0x110e4dc4]
cmp esi, eax
jne 0x11039ea0
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x110e4dc4]
mov dword [eax + 4], eax
mov dword [0x110e4dc8], 0
cmp ecx, dword [0x110e4dc4]
je 0x11039ef9
mov esi, dword [ecx]
mov edx, 1
push 0xc
call fcn.11004ac0
mov ecx, esi
cmp esi, dword [0x110e4dc4]
jne 0x11039ee1
pop esi
pop edi
pop ebx
add esp, 0xc
ret

Function at 0x11039f00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 4]
push ebp
push 0
push eax
push 4
lea eax, [esp + 0x18]
mov ebp, ecx
push eax
push ebp
call ebx
cmp dword [esp + 8], 4
je 0x11039f2d
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
jbe 0x11039f9b
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
cmp dword [esp + 0x10], 4
jne 0x11039fa5
mov eax, dword [esp + 0x18]
mov ebx, dword [0x110e4dc4]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push dword [ebx + 4]
push ebx
call fcn.1103fb30
mov edx, dword [0x110e4dc8]
mov ecx, 0x15555554
sub ecx, edx
mov esi, eax
cmp ecx, 1
jb 0x11039faf
inc edx
inc edi
mov dword [0x110e4dc8], edx
mov dword [ebx + 4], esi
mov eax, dword [esi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [eax], esi
cmp edi, dword [esp + 0x14]
jb 0x11039f37
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
push str.list_T__too_long
call fcn.1107d07e
int3

Function at 0x1103fa80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, edx
mov word [esp + 0xe], cx
sub ebp, edi
xor ecx, ecx
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x14]
cmova ebp, ecx
test ebp, ebp
je 0x1103fadc
push esi
mov esi, dword [edi]
lea eax, [esp + 0x18]
push eax
push 0x40
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [esp + 0x12]
mov word [esi], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x1103faa7
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x110402b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 4
push 0x42cb4a
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esp + 8], 0x43f886
mov ecx, 0x11040260
mov eax, 0x11040280
cmovne eax, ecx
sub eax, 0x42cb4e
mov dword [0x42cb4a], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x42cb4a
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret 4
Function at 0x11040df0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11040ebb
lea ecx, [esp]
push ecx
push str.RemoveCriticalTimelimits
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11040ebb
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11040e3e
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11040ebb
cmp byte [0x110c6683], 0
je 0x11040e6a
test byte [0x110c66ec], 1
je 0x11040e6a
push 1
mov edx, 1
mov ecx, str.Removing_critical_time_limits.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 1
push 0x424118
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov byte [0x424118], 0xeb
push eax
push dword [esp + 4]
push 1
push 0x424118
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov dword [esp], 0x4a3052
push eax
lea edx, [esp + 4]
mov dword [esp + 8], 0x4a3093
mov ecx, 0x9090
call fcn.1103fa80
mov esp, ebp
pop ebp
ret
Function at 0x110433f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x110d6510]
push ebx
push esi
push 0
mov edx, dword [eax]
mov esi, ecx
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x16
push dword [0x110f67ec]
push dword [0x110f67e8]
push eax
call dword [edx + 0x90]
mov eax, dword [0x110d6510]
push dword [esp + 0xc]
push dword [0x110f6910]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x80]
lea eax, [esp + 8]
push eax
mov eax, dword [0x110f67e8]
imul eax, dword [0x110f67ec]
add eax, eax
push eax
call dword [sym.imp.d3dx9_43.dll_D3DXCreateBuffer]
push 0
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x14]
push 3
push eax
call dword [sym.imp.d3dx9_43.dll_D3DXSaveSurfaceToFileInMemory]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
setne bl
test bl, bl
je 0x110434b3
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
movzx eax, bl
pop esi
xor eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x11043ae0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
test edi, edi
jle 0x11043b45
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + edx]
push eax
push ecx
call ebp
test eax, eax
jle 0x11043b1b
add esi, eax
jmp 0x11043b2b
call ebx
cmp eax, 0x2733
je 0x11043b2b
cmp eax, 0x2747
jne 0x11043b39
cmp esi, edi
jge 0x11043b45
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x11043b05
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 4

Function at 0x11043b60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
test edi, edi
jle 0x11043bc5
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + edx]
push eax
push ecx
call ebp
test eax, eax
jle 0x11043b9b
add esi, eax
jmp 0x11043bab
call ebx
cmp eax, 0x2733
je 0x11043bab
cmp eax, 0x2747
jne 0x11043bb9
cmp esi, edi
jge 0x11043bc5
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x11043b85
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 4
Function at 0x110443c0
Capabilities:
Create process on windows
Create tcp socket
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x200
lea eax, [esp + 0x70]
push esi
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x11044510
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x1104450a
mov eax, 2
push str.127.0.0.1
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x1095
mov dword [esp + 0x28], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1104444c
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 4
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x11044439
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.110816e0
add esp, 0xc
mov dword [esp + 0x30], 0x44
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.FalloutDebug.exe__debugedit
push str.FalloutDebug.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x11044439
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x11044439
cmp byte [0x110e58be], 0
jne 0x110444f2
mov ecx, dword [0x110c6684]
test ecx, ecx
je 0x110444f2
mov eax, dword [ecx]
push ecx
call dword [eax + 0x20]
lea ecx, [esp + 0xc]
call fcn.11043be0
push dword [esp + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push edi
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
mov esp, ebp
pop ebp
ret