joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1102a4f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x455405
call esi
mov eax, 0x1102a4d0
sub eax, 0x455409
mov dword [0x455405], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x455405
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x45ebbf
call esi
lea eax, [esp + 8]
mov dword [0x45ebbf], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x45ebbf
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4a4859
call esi
lea eax, [esp + 8]
mov dword [0x4a4859], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x4a4859
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 0xb
push 0x455189
call esi
mov eax, 0x455189
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov byte [eax + 0xa], cl
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 0xb
push 0x455189
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4672a4
call esi
lea eax, [esp + 8]
mov dword [0x4672a4], 0xf02048b
push eax
push dword [esp + 0xc]
push 4
push 0x4672a4
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x4672a8
call esi
mov eax, 0xc3c8
mov word [0x4672a8], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x4672a8
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4673e5
call esi
lea eax, [esp + 8]
mov dword [0x4673e5], 0xf02048b
push eax
push dword [esp + 0xc]
push 4
push 0x4673e5
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4673e9
call esi
lea eax, [esp + 8]
mov byte [0x4673e9], 0xc8
push eax
push dword [esp + 0xc]
push 1
push 0x4673e9
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x467292
call esi
lea eax, [esp + 8]
mov dword [0x467292], 0x66008b66
push eax
push dword [esp + 0xc]
push 4
push 0x467292
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x467296
call esi
lea eax, [esp + 8]
mov dword [0x467296], 0xc308c0c1
push eax
push dword [esp + 0xc]
push 4
push 0x467296
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4d630c
call esi
lea eax, [esp + 8]
mov dword [0x4d630c], 0x9090c031
push eax
push dword [esp + 0xc]
push 4
push 0x4d630c
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4d6310
call esi
lea eax, [esp + 8]
mov byte [0x4d6310], 0x90
push eax
push dword [esp + 0xc]
push 1
push 0x4d6310
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4d6319
call esi
lea eax, [esp + 8]
mov dword [0x4d6319], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x4d6319
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x47d00d
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x47c1fd
mov cl, 0x10
call fcn.1101e0e0
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x47cf0d
call esi
lea eax, [esp + 8]
mov byte [0x47cf0d], 0xcd
push eax
push dword [esp + 0xc]
push 1
push 0x47cf0d
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x47c135
call esi
lea eax, [esp + 8]
mov byte [0x47c135], 0x96
push eax
push dword [esp + 0xc]
push 1
push 0x47c135
call esi
pop esi
add esp, 0x10
ret
Function at 0x1102b0e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, ecx
mov ebx, edx
sub ebx, edi
xor eax, eax
add ebx, 3
xor ebp, ebp
shr ebx, 2
cmp edi, edx
cmova ebx, eax
test ebx, ebx
je 0x1102b13a
push esi
mov edi, edi
mov esi, dword [edi]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
mov dword [esi], eax
mov al, byte [esp + 0x1c]
mov byte [esi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebp
lea edi, [edi + 4]
cmp ebp, ebx
jne 0x1102b100
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x1102b830
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110c67d3], 0
je 0x1102b8d1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43fa9f
call esi
lea eax, [esp + 4]
mov dword [0x43fa9f], 0x501a8c
push eax
push dword [esp + 8]
push 4
push 0x43fa9f
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44eb5b
call esi
lea eax, [esp + 4]
mov dword [0x44eb5b], 0x503530
push eax
push dword [esp + 8]
push 4
push 0x44eb5b
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x48152e
call esi
lea eax, [esp + 4]
mov dword [0x48152e], 0x50b01c
push eax
push dword [esp + 8]
push 4
push 0x48152e
call esi
mov byte [0x110c67d3], 0
pop esi
pop ecx
ret

Function at 0x1102b8e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x110c09b8]
push esi
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov edx, 0x22
mov eax, dword [ebp - 4]
call dword [0x110af084]
cmp eax, 1
sete al
cmp dword [0x110e7cc4], 1
mov byte [0x110c681a], al
jle 0x1102b9bc
test al, al
je 0x1102b9b7
cmp byte [0x110c67d3], 0
jne 0x1102b9bc
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x43fa9f
mov byte [0x110c67d3], 1
call esi
lea eax, [ebp - 4]
mov dword [0x43fa9f], 0x110b545c
push eax
push dword [ebp - 4]
push 4
push 0x43fa9f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44eb5b
call esi
lea eax, [ebp - 4]
mov dword [0x44eb5b], 0x110b5474
push eax
push dword [ebp - 4]
push 4
push 0x44eb5b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x48152e
call esi
lea eax, [ebp - 4]
mov dword [0x48152e], 0x110b548c
push eax
push dword [ebp - 4]
push 4
push 0x48152e
call esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1102b830
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1102be40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.1102bd00
test al, al
jne 0x1102be78
cmp dword [esi + 0x10], 0
je 0x1102be71
cmp dword [esi + 0x14], 0x10
jb 0x1102be5d
mov esi, dword [esi]
push esi
push dword [esp + 0x10]
push 1
push str.Error:__s_invalid_entry:___s__n
call fcn.1100ff40
add esp, 0x10
xor al, al
pop edi
pop esi
ret 4
cmp byte [edi], 0
jne 0x1102be81
xor ecx, ecx
jmp 0x1102be8f
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1102be86
sub ecx, edx
push ecx
push edi
push ecx
mov ecx, esi
call fcn.11021830
cmp dword [esi + 0x14], 0x10
jb 0x1102bea3
mov eax, dword [esi]
jmp 0x1102bea5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1102beef
cmp dword [esi + 0x14], 0x10
jb 0x1102bebb
mov edi, dword [esi]
jmp 0x1102bebd
mov edi, esi
push 2
push 0
push 0x110b2cac
mov ecx, esi
call fcn.1100f880
test eax, eax
jne 0x1102bed4
add edi, 2
push edi
push dword [esp + 0x10]
push 1
push str.Error:__s_entry_not_found:__s_n
call fcn.1100ff40
add esp, 0x10
xor al, al
pop edi
pop esi
ret 4
pop edi
mov al, 1
pop esi
ret 4
Function at 0x1102c740
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
cmp byte [0x110c6683], 0
push esi
je 0x1102c767
test byte [0x110c66ec], 1
je 0x1102c767
push 1
mov edx, 1
mov ecx, str.Applying_load_multiple_patches_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x444354
call esi
lea eax, [esp + 8]
mov byte [0x444354], 0x90
push eax
push dword [esp + 0xc]
push 1
push 0x444354
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x44435c
call esi
lea eax, [esp + 8]
mov byte [0x44435c], 0xc4
push eax
push dword [esp + 0xc]
push 1
push 0x44435c
call esi
pop esi
add esp, 8
ret

Function at 0x1102c9b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x6143f4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1102c9d3
test al, 1
je 0x1102c9d3
and eax, 0xfffffffe
push eax
push 0x6143f4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x1102ec70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp dword [0x110e7ccc], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, ecx
jne 0x1102ecb0
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4a364a
call esi
lea eax, [esp + 8]
mov dword [0x4a364a], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x4a364a
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
test ebx, ebx
je 0x1102ed1c
push 0x4831d9
call esi
lea eax, [esp + 8]
mov byte [0x4831d9], bl
push eax
push dword [esp + 0xc]
push 1
push 0x4831d9
call esi
cmp dword [0x110e7ccc], 2
jne 0x1102ed0e
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4831da
call esi
lea eax, [esp + 8]
mov byte [0x4831da], 0x7c
push eax
push dword [esp + 0xc]
push 1
push 0x4831da
call esi
pop esi
mov dword [0x110e7ccc], 1
pop ebx
pop ecx
ret
push 0x4831da
call esi
lea eax, [esp + 8]
mov byte [0x4831da], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x4831da
call esi
pop esi
mov dword [0x110e7ccc], 2
pop ebx
pop ecx
ret

Function at 0x1102ee50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4a21b2
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1102ee20
mov byte [0x4a21b2], 0xe8
sub eax, 0x4a21b7
mov dword [0x4a21b3], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4a21b2
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x11031530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110e6caf], 0
je 0x1103164e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x49952c
mov byte [0x110e6caf], 0
call esi
lea eax, [esp + 4]
mov byte [0x49952c], 0x85
push eax
push dword [esp + 8]
push 1
push 0x49952c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x497557
call esi
lea eax, [esp + 4]
mov byte [0x497557], 0x85
push eax
push dword [esp + 8]
push 1
push 0x497557
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x42e587
call esi
lea eax, [esp + 4]
mov byte [0x42e587], 0xc7
push eax
push dword [esp + 8]
push 1
push 0x42e587
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42e588
call esi
lea eax, [esp + 4]
mov dword [0x42e588], 0x10c2444
push eax
push dword [esp + 8]
push 4
push 0x42e588
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x499fd4
call esi
mov eax, 0xc201
mov word [0x499fd4], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x499fd4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x499e93
call esi
mov eax, 0x574
mov word [0x499e93], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x499e93
call esi
pop esi
pop ecx
ret
Function at 0x11031650
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x110316f8
lea ecx, [esp + 8]
push ecx
push str.LocalMapXLimit
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110316f8
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x1103169c
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
test edi, edi
jle 0x110316f8
cmp byte [0x110c6683], 0
je 0x110316ca
test byte [0x110c66ec], 1
je 0x110316ca
push 1
mov edx, 1
mov ecx, str.Applying_local_map_x_limit_patch.
call fcn.11011060
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4b13b9
call esi
lea eax, [esp + 8]
mov dword [0x4b13b9], edi
push eax
push dword [esp + 0xc]
push 4
push 0x4b13b9
call esi
mov dword [0x110c679c], edi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11031797
lea ecx, [esp + 8]
push ecx
push str.LocalMapYLimit
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11031797
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x1103173b
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
test edi, edi
jle 0x11031797
cmp byte [0x110c6683], 0
je 0x11031769
test byte [0x110c66ec], 1
je 0x11031769
push 1
mov edx, 1
mov ecx, str.Applying_local_map_y_limit_patch.
call fcn.11011060
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4b13c7
call esi
lea eax, [esp + 8]
mov dword [0x4b13c7], edi
push eax
push dword [esp + 0xc]
push 4
push 0x4b13c7
call esi
mov dword [0x110c6798], edi
cmp byte [0x110c6683], 0
je 0x110317ba
test byte [0x110c66ec], 1
je 0x110317ba
push 1
mov edx, 1
mov ecx, str.Applying_cities_limit_patch.
call fcn.11011060
cmp byte [0x4bf3bb], 0xeb
je 0x110317ec
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4bf3bb
call esi
lea eax, [esp + 8]
mov byte [0x4bf3bb], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x4bf3bb
call esi
pop edi
pop esi
pop ecx
ret
Function at 0x110317f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11031843
lea ecx, [esp + 8]
push ecx
push str.TimeLimit
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11031843
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x1103183a
mov ecx, dword [ecx]
call fcn.11011f90
mov ebx, eax
jmp 0x11031848
mov ebx, 0xd
cmp ebx, 0xfffffffe
je 0x11031866
cmp ebx, 0xfffffffd
je 0x11031866
cmp ebx, 0xffffffff
jl 0x11031a04
cmp ebx, 0xd
jge 0x11031a04
jmp 0x11031883
push 1
push 0x11031170
mov edx, 0x4a33b8
mov byte [0x110c683f], 1
mov cl, 0xe8
call fcn.1100fb30
or ebx, 0xffffffff
cmp byte [0x110c6683], 0
je 0x110318a6
test byte [0x110c66ec], 1
je 0x110318a6
push 1
mov edx, 1
mov ecx, str.Applying_time_limit_patch.
call fcn.11011060
cmp ebx, 0xffffffff
jne 0x110319ae
push 1
push 0x110311d0
mov edx, 0x4a3df5
mov cl, 0xe8
call fcn.1100fb30
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4a3488
call esi
mov eax, 0x110311f0
mov byte [0x4a3488], 0xe8
sub eax, 0x4a348d
mov dword [0x4a3489], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4a3488
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4a34ef
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x4a3547
push eax
push ecx
mov ecx, fcn.11031180
call fcn.1100fd70
lea eax, [esp + 8]
push eax
push 0x40
push 0x10
push 0x4a34f4
call esi
mov eax, 0x4a34f4
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 0x10
push 0x4a34f4
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 0x10
push 0x4a354c
call esi
mov eax, 0x4a354c
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 0x10
push 0x4a354c
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4a34ec
call esi
lea eax, [esp + 8]
mov byte [0x4a34ec], bl
push eax
push dword [esp + 0xc]
push 1
push 0x4a34ec
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4a3544
call esi
lea eax, [esp + 8]
mov byte [0x4a3544], bl
push eax
push dword [esp + 0xc]
push 1
push 0x4a3544
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x11031cc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110c6683], 0
je 0x11031ce4
test byte [0x110c66ec], 1
je 0x11031ce4
push 1
mov edx, 1
mov ecx, str.Applying_Pathfinder_patch.
call fcn.11011060
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x4c1ff6
call esi
mov eax, 0x9090
mov word [0x4c1ff6], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x4c1ff6
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c1c79
call esi
mov eax, 0x110313e0
sub eax, 0x4c1c7d
mov dword [0x4c1c79], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4c1c79
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
pop esi
test eax, eax
je 0x11031da0
lea ecx, [esp]
push ecx
push str.WorldMapTimeMod
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11031da0
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11031d87
mov ecx, dword [ecx]
call fcn.11011f90
mov dword [esp], eax
fild dword [esp]
fmul qword [0x110bad98]
fstp qword [0x110c0b40]
pop ecx
ret
mov dword [esp], 0x64
fild dword [esp]
fmul qword [0x110bad98]
fstp qword [0x110c0b40]
pop ecx
ret
Function at 0x11032340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110c6683], 0
je 0x11032364
test byte [0x110c66ec], 1
je 0x11032364
push 1
mov edx, 1
mov ecx, str.Applying_Pip_Boy_automaps_patch.
call fcn.11011060
push esi
push edi
push 2
push 0x11031420
mov edx, 0x4bf931
mov cl, 0xe8
call fcn.1100fb30
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x41b8b7
call esi
lea eax, [esp + 8]
mov dword [0x41b8b7], 0x110e7d08
push eax
push dword [esp + 0xc]
push 4
push 0x41b8b7
call esi
mov ecx, 0xa0
mov esi, 0x41b560
mov edi, 0x110e7d08
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ecx
ret

Function at 0x110323c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x110e4c8c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push edi
push 0
mov dword [esp + 0x14], eax
mov edi, ecx
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call ebx
mov eax, dword [0x110e4c88]
mov esi, dword [eax]
cmp esi, eax
je 0x1103241d
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esi + 8]
push eax
push edi
call ebx
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esi + 0xc]
push eax
push edi
call ebx
mov esi, dword [esi]
cmp esi, dword [0x110e4c88]
jne 0x110323f3
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x11032430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x14]
push 0
push eax
push 4
lea eax, [esp + 0x28]
mov esi, ecx
push eax
push esi
call edi
cmp dword [esp + 0x14], 4
je 0x11032461
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
test eax, eax
je 0x1103255a
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x30]
push eax
push esi
call edi
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x2c]
push eax
push esi
call edi
cmp dword [esp + 0x14], 4
jne 0x11032457
mov eax, dword [0x110e4c88]
mov ebx, dword [eax]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push dword [ebx + 4]
push ebx
call fcn.110333d0
mov edx, dword [0x110e4c8c]
mov ecx, 0xffffffe
sub ecx, edx
mov ebp, eax
cmp ecx, 1
jb 0x11032564
inc edx
mov ecx, 0x110e4c84
mov dword [0x110e4c8c], edx
mov dword [ebx + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
mov eax, dword [0x110e4c88]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [esp + 0x30]
push eax
call fcn.11026220
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, eax
jb 0x11032475
test eax, eax
je 0x1103255a
cmp byte [0x110e6cae], 0
jne 0x1103255a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push 0x42e57b
call esi
mov eax, 0x11031400
sub eax, 0x42e57f
mov dword [0x42e57b], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 4
push 0x42e57b
call esi
mov byte [0x110e6cae], 1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x24
ret
push str.list_T__too_long
call fcn.1107d07e
int3
Function at 0x11032570
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
mov ebx, ecx
call fcn.11031530
test bl, 7
seta al
mov byte [0x110e6caf], al
test al, al
je 0x110326a8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, 1
je 0x110325ee
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x49952c
call esi
lea eax, [esp + 8]
mov byte [0x49952c], 0x31
push eax
push dword [esp + 0xc]
push 1
push 0x49952c
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x497557
call esi
lea eax, [esp + 8]
mov byte [0x497557], 0x31
push eax
push dword [esp + 0xc]
push 1
push 0x497557
call esi
pop esi
pop ebx
pop ecx
ret
test bl, 2
je 0x11032648
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x42e587
call esi
lea eax, [esp + 8]
mov byte [0x42e587], 0xe9
push eax
push dword [esp + 0xc]
push 1
push 0x42e587
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x42e588
call esi
lea eax, [esp + 8]
mov dword [0x42e588], 0x94
push eax
push dword [esp + 0xc]
push 4
push 0x42e588
call esi
test bl, 4
je 0x110326a7
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x499fd4
call esi
mov eax, 0x9090
mov word [0x499fd4], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x499fd4
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x499e93
call esi
mov eax, 0x8feb
mov word [0x499e93], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x499e93
call esi
pop esi
pop ebx
pop ecx
ret

Function at 0x110326b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x14
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ecx
push eax
lea eax, [esp + 0xc]
mov edi, edx
push eax
call fcn.11033040
mov eax, dword [esp + 8]
cmp eax, dword [0x110e4c88]
je 0x110326f4
mov cl, byte [esp + 0x1c]
cmp edi, 0xffffffff
jne 0x110326e9
mov byte [eax + 0xc], cl
mov edi, 2
mov byte [eax + 0xd], cl
mov byte [eax + edi + 0xc], cl
pop edi
add esp, 0x14
ret 4
cmp byte [0x110e6cae], 0
jne 0x1103273d
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x42e57b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11031400
sub eax, 0x42e57f
mov dword [0x42e57b], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x42e57b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x110e6cae], 1
mov al, byte [esp + 0x1c]
mov dword [esp + 8], 0xffffffff
cmp edi, 0xffffffff
jne 0x1103275b
mov byte [esp + 8], al
mov edi, 2
mov byte [esp + 9], al
mov byte [esp + edi + 8], al
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.11033250
pop edi
add esp, 0x14
ret 4