joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110622c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x47d80d
call esi
mov eax, 0x11061b40
mov byte [0x47d80d], 0xe8
sub eax, 0x47d812
mov dword [0x47d80e], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x47d80d
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x47e6e8
call esi
mov eax, 0x11062270
mov byte [0x47e6e8], 0xe8
sub eax, 0x47e6ed
mov dword [0x47e6e9], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x47e6e8
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x47bd49
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x47cb1c
push eax
push ecx
mov ecx, 0x11061fd0
call fcn.1100fd70
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x47d828
call esi
mov eax, 0x110619d0
mov byte [0x47d828], 0xe8
sub eax, 0x47d82d
mov dword [0x47d829], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x47d828
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x47b82b
call esi
mov eax, 0x11061b30
mov byte [0x47b82b], 0xe8
sub eax, 0x47b830
mov dword [0x47b82c], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x47b82b
call esi
mov dword [esp + 0x10], 0x47b929
mov dword [esp + 0x14], 0x47d8db
mov dword [esp + 0x18], 0x47d9b0
mov dword [esp + 0x1c], 0x47da34
mov dword [esp + 0x20], 0x47dabf
mov dword [esp + 0x24], 0x47db58
mov dword [esp + 0x28], 0x47dbe9
lea eax, [esp + 0x84]
mov dword [esp + 0x2c], 0x47dc9c
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0x47ec77
push eax
push ecx
mov ecx, 0x11062280
mov dword [esp + 0x3c], 0x47f5ab
mov dword [esp + 0x40], 0x47f694
mov dword [esp + 0x44], 0x47f6eb
mov dword [esp + 0x48], 0x47f7fb
mov dword [esp + 0x4c], 0x47f892
mov dword [esp + 0x50], 0x47fb86
mov dword [esp + 0x54], 0x47fc3a
mov dword [esp + 0x58], 0x47fcf2
mov dword [esp + 0x5c], 0x480117
mov dword [esp + 0x60], 0x4801cf
mov dword [esp + 0x64], 0x480234
mov dword [esp + 0x68], 0x480310
mov dword [esp + 0x6c], 0x4803f3
mov dword [esp + 0x70], 0x48049f
mov dword [esp + 0x74], 0x480512
mov dword [esp + 0x78], 0x4805f2
mov dword [esp + 0x7c], 0x480767
mov dword [esp + 0x80], 0x4807e6
mov dword [esp + 0x84], 0x480839
mov dword [esp + 0x88], 0x4808d3
call fcn.1100fd70
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x47e5e1
call esi
mov eax, 0x11062290
mov byte [0x47e5e1], 0xe9
sub eax, 0x47e5e6
mov dword [0x47e5e2], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x47e5e1
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x47e756
call esi
mov eax, 0x110622b0
mov byte [0x47e756], 0xe8
sub eax, 0x47e75b
mov dword [0x47e757], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x47e756
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x11067d60
Capabilities:
Get file attributes

Disassembly:
sub esp, 8
push ebp
push esi
mov ebp, ecx
mov esi, edx
push 0x110b8b84
push ebp
mov dword [esp + 0x14], esi
call fcn.110808c0
add esp, 8
mov dword [esp + 8], eax
mov dword [esi], eax
test eax, eax
jne 0x11067d90
pop esi
or eax, 0xffffffff
pop ebp
add esp, 8
ret 8
push ebx
mov ebx, eax
sub ebx, ebp
cmp dword [0x110e4cec], 0
jne 0x11067daf
cmp ebx, 0x40
jb 0x11067daf
pop ebx
pop esi
or eax, 0xffffffff
pop ebp
add esp, 8
ret 8
push edi
inc eax
push 0x110b8b84
push eax
call fcn.110808c0
mov edi, eax
add esp, 8
mov dword [esi], edi
test edi, edi
je 0x11067dd1
sub edi, ebx
sub edi, ebp
dec edi
cmp edi, 0x20
jbe 0x11067dde
pop edi
pop ebx
pop esi
or eax, 0xffffffff
pop ebp
add esp, 8
ret 8
mov esi, dword [esp + 0x20]
mov word [esi], 0x5c2e
cmp dword [0x110e4cec], 0
je 0x11067e52
mov edx, dword [esp + 0x10]
mov ecx, ebp
call fcn.11067d20
test al, al
jne 0x11067e52
cmp dword [0x110e4cf0], 0x10
mov eax, 0x110e4cdc
mov esi, dword [0x110e4cec]
cmovae eax, dword [0x110e4cdc]
push esi
push eax
mov eax, dword [esp + 0x28]
add eax, 2
push eax
call fcn.11081160
mov eax, dword [esp + 0x2c]
push ebx
add eax, 2
add eax, esi
push ebp
push eax
call fcn.11081160
lea eax, [esi + ebx]
add esp, 0x18
mov esi, dword [esp + 0x20]
push esi
mov byte [eax + esi + 2], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x11067e65
push ebx
lea eax, [esi + 2]
push ebp
push eax
call fcn.11081160
add esp, 0xc
mov byte [ebx + esi + 2], 0
mov esi, dword [esp + 0x1c]
lea eax, [ebp + 1]
push edi
add eax, ebx
push eax
push esi
call fcn.11081160
mov eax, dword [esp + 0x20]
add esp, 0xc
mov byte [edi + esi], 0
inc dword [eax]
mov eax, 1
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret 8
Function at 0x11068280
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1109e2b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [edx]
push edi
mov edi, ecx
mov dword [ebp - 0x14], 0
push 2
push 0x110b2cac
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.11004980
mov dword [ebp - 4], 0
cmp dword [0x110e4cec], 0
jne 0x11068344
cmp byte [esi], 0
jne 0x110682e5
xor ecx, ecx
jmp 0x110682f9
mov ecx, esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x110682f0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.11008f90
lea eax, [ebp - 0x2c]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov ecx, edi
push eax
mov byte [edi], 0
call fcn.110044e0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x11068332
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.11004ac0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0
push 0x110e4cdc
lea ecx, [ebp - 0x2c]
call fcn.110090c0
cmp byte [esi], 0
jne 0x1106835e
xor ecx, ecx
jmp 0x1106836c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x11068363
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.11008f90
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x11068303
mov edx, 2
sub edx, esi
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov al, byte [esi]
cmovae ecx, dword [ebp - 0x2c]
add ecx, edx
mov byte [ecx + esi], al
cmp byte [esi], 0
je 0x11068303
inc esi
jmp 0x11068397

Function at 0x11068c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push ebp
push esi
lea esi, [eax + 8]
mov ebp, ecx
push edi
jb 0x11068c48
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x11068c64
movzx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x11068c53
mov ecx, dword [ebp + 0x18]
and ecx, edi
lea edx, [ecx*8]
mov ecx, dword [ebp + 0xc]
add ecx, edx
cmp dword [ecx + 4], eax
jne 0x11068c97
cmp dword [ecx], eax
jne 0x11068c8f
mov eax, dword [ebp + 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
mov dword [ecx + edx + 4], eax
jmp 0x11068c9f
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x11068c9f
cmp dword [ecx], eax
jne 0x11068ca3
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push eax
push esi
call fcn.11068d30
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x11068dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1109ee30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov ecx, dword [eax + 0x14]
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
cmp ecx, 0x10
jb 0x11068e02
mov esi, dword [eax]
jmp 0x11068e04
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x11068e21
nop
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x11068e10
mov eax, dword [edi + 0x18]
lea ecx, [edi + 4]
and eax, edx
mov dword [ebp - 0x28], ecx
lea edx, [eax*8]
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x14], edx
mov edi, dword [eax + edx]
cmp edi, dword [ecx]
jne 0x11068e44
mov esi, dword [ecx]
jmp 0x11068e4a
mov esi, dword [eax + edx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x11068e9a
mov edi, edi
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
lea ecx, [edx + 0x10]
mov dword [ebp - 0x24], ecx
jb 0x11068e64
mov edx, dword [edx]
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp + 0xc]
jb 0x11068e6f
mov eax, dword [eax]
mov ecx, dword [ecx]
cmp ebx, ecx
mov dword [ebp - 0x18], eax
mov eax, ecx
mov ecx, dword [ebp - 0x18]
cmovb eax, ebx
push eax
call fcn.1100c510
add esp, 4
test eax, eax
jne 0x11068e96
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
cmp ebx, eax
jb 0x11068e96
jbe 0x11068ee5
cmp esi, edi
jne 0x11068e50
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x11068ec7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add ecx, dword [edx + 0xc]
mov eax, dword [ecx]
cmp eax, dword [edx + 4]
jne 0x11068f10
mov dword [ecx], edi
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax + ecx + 4], edi
jmp 0x11068f33
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
lea eax, [ebp + 0xc]
push eax
call fcn.11068d30
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x11068f18
mov dword [ecx], edi
jmp 0x11068f33
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x11068f33
mov ecx, dword [ebp - 0x14]
add ecx, dword [edx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, edx
mov dword [ebp - 4], 2
call fcn.11068f80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1106a050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
mov al, byte [0x110c0e1f]
test ecx, ecx
push ebx
setne bl
mov byte [0x110c0e1f], bl
cmp al, bl
je 0x1106a1dc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459c97
call esi
lea eax, [esp + 8]
mov byte [0x459c97], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459c97
call esi
mov bl, byte [0x110c0e1f]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459d4b
call esi
lea eax, [esp + 8]
mov byte [0x459d4b], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459d4b
call esi
mov bl, byte [0x110c0e1f]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459e3b
call esi
lea eax, [esp + 8]
mov byte [0x459e3b], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459e3b
call esi
mov bl, byte [0x110c0e1f]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459eeb
call esi
lea eax, [esp + 8]
mov byte [0x459eeb], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459eeb
call esi
mov bl, byte [0x110c0e1f]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459f9f
call esi
lea eax, [esp + 8]
mov byte [0x459f9f], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459f9f
call esi
mov bl, byte [0x110c0e1f]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x45a053
call esi
lea eax, [esp + 8]
mov byte [0x45a053], bl
push eax
push dword [esp + 0xc]
push 1
push 0x45a053
call esi
mov bl, byte [0x110c0e1f]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x45a10b
call esi
lea eax, [esp + 8]
mov byte [0x45a10b], bl
push eax
push dword [esp + 0xc]
push 1
push 0x45a10b
call esi
mov bl, byte [0x110c0e1f]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x45ae53
call esi
lea eax, [esp + 8]
mov byte [0x45ae53], bl
push eax
push dword [esp + 0xc]
push 1
push 0x45ae53
call esi
pop esi
pop ebx
pop ecx
ret
Function at 0x1106dd00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
cmp ebx, 0x10
jb 0x1106dd19
mov esi, dword [ebp]
jmp 0x1106dd1b
mov esi, ebp
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1106dd37
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1106dd26
mov eax, dword [0x110e57d4]
mov ecx, dword [0x110e57c8]
and eax, edx
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [esp + 0x1c], edx
lea eax, [ecx + eax*4]
mov dword [esp + 0x10], eax
jmp 0x1106dd60
mov ecx, dword [0x110e57c0]
cmp edx, ecx
jne 0x1106dd6e
mov eax, ecx
jmp 0x1106dd72
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1106de08
lea ecx, [esi + 8]
cmp ebx, 0x10
jb 0x1106dd87
mov edx, dword [ebp]
jmp 0x1106dd89
mov edx, ebp
cmp dword [ecx + 0x14], 0x10
lea ebx, [ecx + 0x10]
jb 0x1106dd94
mov ecx, dword [ecx]
mov ebx, dword [ebx]
mov eax, edi
cmp ebx, edi
cmovb eax, ebx
push eax
call fcn.1100c510
add esp, 4
test eax, eax
jne 0x1106ddb0
cmp ebx, edi
jb 0x1106ddb0
jbe 0x1106ddbf
mov esi, dword [esi]
mov ebx, dword [ebp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
jmp 0x1106dd60
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
lea ebx, [edx + 0x10]
jb 0x1106ddcd
mov edx, dword [edx]
cmp dword [ebp + 0x14], 0x10
jb 0x1106ddd6
mov ebp, dword [ebp]
mov ebx, dword [ebx]
mov ecx, ebp
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
call fcn.1100c510
add esp, 4
test eax, eax
jne 0x1106ddf4
cmp edi, ebx
jb 0x1106ddf4
jbe 0x1106ddfa
mov esi, dword [0x110e57c0]
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret 8

Function at 0x11070630
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [ecx + 0x19]
cmp eax, 0x32
ja 0x11070686
cmp byte [0x110fca85], 0
mov dword [0x110d8724], ecx
jne 0x11070686
lea eax, [esp]
mov byte [0x110fca85], 1
push eax
push 0x40
push 4
push 0x496880
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11070610
sub eax, 0x496884
mov dword [0x496880], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x496880
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x11071ea0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x110e5190]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x110e519c]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x110e5188]
cmp edi, edx
jne 0x11071f00
mov ecx, edx
jmp 0x11071f05
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x11071f2a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x11071f14
mov eax, dword [eax]
jmp 0x11071ef8
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8

Function at 0x11071f40
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
cmp dword [0x110c0e58], 0xffffffff
jne 0x11071f52
xor eax, eax
add esp, 0xc
ret
lea eax, [esp]
mov dword [esp + 8], 0x67
push eax
push 0x40
push 5
push 0x4c06d1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 8]
mov ecx, 0x4c06d1
mov dword [ecx], 0x2e043d83
mov byte [ecx + 4], al
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x110c0e58]
mov dword [0x110fb788], 0
mov dword [0x110c0e58], 0xffffffff
add esp, 0xc
ret

Function at 0x11072880
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x45f627
call esi
mov eax, 0x110727d0
sub eax, 0x45f62b
mov dword [0x45f627], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x45f627
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4432a7
call esi
mov eax, 0x110727f0
sub eax, 0x4432ab
mov dword [0x4432a7], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4432a7
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x477f4d
call esi
mov eax, 0x11072830
sub eax, 0x477f51
mov dword [0x477f4d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x477f4d
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4298f4
call esi
mov eax, 0x11072810
mov byte [0x4298f4], 0xe8
sub eax, 0x4298f9
mov dword [0x4298f5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4298f4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x426669
call esi
mov eax, 0x11072850
mov byte [0x426669], 0xe8
sub eax, 0x42666e
mov dword [0x42666a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x426669
call esi
pop esi
pop ecx
ret
Function at 0x110733f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push 1
push 0x11072df0
mov edx, 0x4cafe6
mov cl, 0xe8
call fcn.1100fb30
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x4cafee
call esi
lea eax, [esp + 4]
mov byte [0x4cafee], 0xe9
push eax
push dword [esp + 8]
push 1
push 0x4cafee
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4cafef
call esi
lea eax, [esp + 4]
mov dword [0x4cafef], 0x1b1
push eax
push dword [esp + 8]
push 4
push 0x4cafef
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4cae72
call esi
lea eax, [esp + 4]
mov dword [0x4cae72], 0x11073100
push eax
push dword [esp + 8]
push 4
push 0x4cae72
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4cae77
call esi
lea eax, [esp + 4]
mov dword [0x4cae77], 0x11004550
push eax
push dword [esp + 8]
push 4
push 0x4cae77
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44260d
call esi
mov eax, 0x11073330
sub eax, 0x442611
mov dword [0x44260d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44260d
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4cb311
call esi
mov byte [0x4cb311], 0xe9
mov eax, 0x11073300
sub eax, 0x4cb316
mov dword [0x4cb312], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4cb311
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4cb568
call esi
mov eax, 0x11073310
mov byte [0x4cb568], 0xe9
sub eax, 0x4cb56d
mov dword [0x4cb569], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4cb568
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4cb1fd
call esi
mov eax, 0x110733a0
mov byte [0x4cb1fd], 0xe8
sub eax, 0x4cb202
mov dword [0x4cb1fe], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4cb1fd
call esi
push 1
push 0x11073340
mov edx, 0x4f5dd1
mov cl, 0xe8
call fcn.1100fb30
push 1
push 0x11073340
mov edx, 0x4f5df6
mov cl, 0xe8
call fcn.1100fb30
pop esi
pop ecx
ret

Function at 0x11073650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 5
push 0x496f5e
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11073630
mov byte [0x496f5e], 0xe8
sub eax, 0x496f63
mov dword [0x496f5f], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x496f5e
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 1
push 0x11073640
mov edx, 0x4a289c
mov cl, 0xe8
call fcn.1100fb30
pop ecx
ret
Function at 0x110742d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
push 1
push 0x110741d0
mov edx, 0x42d0f2
mov cl, 0xe8
call fcn.1100fb30
push 1
push 0x110741f0
mov edx, 0x42d0c4
mov cl, 0xe8
call fcn.1100fb30
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d12a
call esi
mov eax, 0x11074240
mov byte [0x42d12a], 0xe8
sub eax, 0x42d12f
mov dword [0x42d12b], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d12a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x477ae8
call esi
mov eax, 0x11074260
sub eax, 0x477aec
mov dword [0x477ae8], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x477ae8
call esi
sub esp, 0x28
mov ecx, 0x11074280
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x1107438e
mov dword [eax], 0x110b3d0c
mov dword [eax + 4], 0x11074280
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x110e5178
push eax
call fcn.110053e0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x110743d7
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
sub esp, 0x28
mov ecx, 0x110e5118
mov eax, esp
mov dword [eax], 0x110bab48
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.110053e0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1107442e
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
pop esi
add esp, 0x10
ret

Function at 0x110744a0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x110e5800]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x110e580c]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x110e57f8]
cmp edi, edx
jne 0x11074500
mov ecx, edx
jmp 0x11074505
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1107452a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x11074514
mov eax, dword [eax]
jmp 0x110744f8
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8