joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110291e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x18
push esi
mov dword [esp + 8], 0x411ea2
mov dword [esp + 0xc], 0x412046
mov dword [esp + 0x10], 0x41224a
mov dword [esp + 0x14], 0x4606a5
mov dword [esp + 0x18], 0x472996
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11029355
lea ecx, [esp + 4]
push ecx
push str.InstantWeaponEquip
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11029355
mov ecx, dword [esp + 4]
cmp dword [ecx + 0x14], 0x10
jb 0x11029253
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11029355
cmp byte [0x110c6683], 0
je 0x11029283
test byte [0x110c66ec], 1
je 0x11029283
push 1
mov edx, 1
mov ecx, str.Applying_instant_weapon_equip_patch.
call fcn.11011060
lea eax, [esp + 0x1c]
mov cl, 0xeb
push eax
lea edx, [esp + 0xc]
call fcn.1101e0e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x472ad5
call esi
lea eax, [esp + 4]
mov dword [0x472ad5], 0x441f0f
push eax
push dword [esp + 8]
push 4
push 0x472ad5
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x472ae0
call esi
lea eax, [esp + 4]
mov dword [0x472ae0], 0x441f0f
push eax
push dword [esp + 8]
push 4
push 0x472ae0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x472af0
call esi
lea eax, [esp + 4]
mov dword [0x472af0], 0x441f0f
push eax
push dword [esp + 8]
push 4
push 0x472af0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x415238
call esi
mov eax, 0x110282a0
mov byte [0x415238], 0xe9
sub eax, 0x41523d
mov dword [0x415239], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x415238
call esi
pop esi
add esp, 0x18
ret

Function at 0x11029360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110293f9
lea ecx, [esp]
push ecx
push str.DontTurnOffSneakIfYouRun
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110293f9
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x1102939e
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x110293f9
cmp byte [0x110c6683], 0
je 0x110293ca
test byte [0x110c66ec], 1
je 0x110293ca
push 1
mov edx, 1
mov ecx, str.Applying_DontTurnOffSneakIfYouRun_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 1
push 0x418135
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov byte [0x418135], 0xeb
push eax
push dword [esp + 4]
push 1
push 0x418135
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x11029400
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110294a5
lea ecx, [esp]
push ecx
push str.PlayIdleAnimOnReload
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110294a5
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11029442
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x110294a5
cmp byte [0x110c6683], 0
je 0x1102946e
test byte [0x110c66ec], 1
je 0x1102946e
push 1
mov edx, 1
mov ecx, str.Applying_idle_anim_on_reload_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 4
push 0x460b8d
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11028310
sub eax, 0x460b91
mov dword [0x460b8d], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x460b8d
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x110294b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11029503
lea ecx, [esp + 8]
push ecx
push str.MotionScannerFlags
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11029503
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x110294f2
mov ecx, dword [ecx]
call fcn.11011f90
mov ebx, eax
test ebx, ebx
je 0x110295f9
jmp 0x11029508
mov ebx, 1
cmp byte [0x110c6683], 0
je 0x1102952b
test byte [0x110c66ec], 1
je 0x1102952b
push 1
mov edx, 1
mov ecx, str.Applying_MotionScannerFlags_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, 1
je 0x1102956e
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x41bbe9
call esi
mov eax, 0x11028350
mov byte [0x41bbe9], 0xe9
sub eax, 0x41bbee
mov dword [0x41bbea], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x41bbe9
call esi
test bl, 2
je 0x110295f9
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x41bc24
call esi
mov eax, 0x9090
mov word [0x41bc24], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x41bc24
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x41bc3c
call esi
lea eax, [esp + 8]
mov dword [0x41bc3c], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x41bc3c
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4794b3
call esi
lea eax, [esp + 8]
mov byte [0x4794b3], 0x5e
push eax
push dword [esp + 0xc]
push 1
push 0x4794b3
call esi
pop esi
pop ebx
pop ecx
ret
Function at 0x11029610
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x38
push ebx
mov dword [esp + 0x10], 0x4bd1a3
mov dword [esp + 0x14], 0x4bd1d9
mov dword [esp + 0x18], 0x4bd270
mov dword [esp + 0x1c], 0x4bd604
mov dword [esp + 0x20], 0x4bda14
mov dword [esp + 0x24], 0x4bda44
mov dword [esp + 0x28], 0x4be707
mov dword [esp + 0x2c], 0x4c0815
mov dword [esp + 0x30], 0x4c0d4a
mov dword [esp + 0x34], 0x4c0fd4
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110296ac
lea ecx, [esp + 8]
push ecx
push str.EncounterTableSize
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110296ac
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x110296a3
mov ecx, dword [ecx]
call fcn.11011f90
mov ebx, eax
jmp 0x110296ae
xor ebx, ebx
cmp ebx, 0x28
jle 0x11029757
cmp byte [0x110c6683], 0
je 0x110296da
test byte [0x110c66ec], 1
je 0x110296da
push 1
mov edx, 1
mov ecx, str.Applying_EncounterTableSize_patch.
call fcn.11011060
cmp ebx, 0x32
jle 0x1102970d
mov eax, 0x64
mov dword [esp + 8], 0x4c102c
cmp ebx, eax
mov dword [esp + 0xc], 0x4c0b57
lea ecx, [esp + 8]
cmovg ebx, eax
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, 0x11029600
call fcn.1100fd70
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4bdb17
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov byte [0x4bdb17], bl
push eax
push dword [esp + 0xc]
push 1
push 0x4bdb17
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
imul ecx, ebx, 0xb4
lea eax, [esp + 0x38]
push eax
lea edx, [esp + 0x14]
add ecx, 0x104
call fcn.1100f980
pop ebx
add esp, 0x38
ret

Function at 0x11029760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1102982f
lea ecx, [esp + 8]
push ecx
push str.DisablePipboyAlarm
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x1102982f
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x110297ab
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x1102982f
cmp byte [0x110c6683], 0
je 0x110297d7
test byte [0x110c66ec], 1
je 0x110297d7
push 1
mov edx, 1
mov ecx, str.Applying_Disable_Pip_Boy_alarm_button_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x499518
call esi
lea eax, [esp + 8]
mov byte [0x499518], 0xc3
push eax
push dword [esp + 0xc]
push 1
push 0x499518
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x443601
call esi
lea eax, [esp + 8]
mov byte [0x443601], 0
push eax
push dword [esp + 0xc]
push 1
push 0x443601
call esi
pop esi
add esp, 8
ret
Function at 0x11029840
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110298e5
lea ecx, [esp]
push ecx
push str.ObjCanSeeObj_ShootThru_Fix
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110298e5
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11029882
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x110298e5
cmp byte [0x110c6683], 0
je 0x110298ae
test byte [0x110c66ec], 1
je 0x110298ae
push 1
mov edx, 1
mov ecx, str.Applying_obj_can_see_obj_fix_for_seeing_through_critters_and_ShootThru_objects.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 4
push 0x456bc7
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11028400
sub eax, 0x456bcb
mov dword [0x456bc7], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x456bc7
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x110298f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110299c3
lea ecx, [esp + 8]
push ecx
push str.OverrideMusicDir
push str.Sound
mov ecx, eax
call fcn.11003200
test al, al
je 0x110299c3
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x1102993b
mov ecx, dword [ecx]
call fcn.11011f90
mov esi, eax
test esi, esi
je 0x110299c3
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4449c2
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x4449db
mov ecx, str.data_soundmusic_
call fcn.1100f980
cmp esi, 2
jne 0x110299c3
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x518e78
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x518e7c
mov ecx, str.data_soundmusic_
call fcn.1100f980
lea eax, [esp + 8]
push eax
push 0x40
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x44fcf3
call esi
mov eax, 0x40eb
mov word [0x44fcf3], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x44fcf3
call esi
pop esi
add esp, 0x10
ret

Function at 0x110299d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11029a17
lea ecx, [esp]
push ecx
push str.DialogueFix
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11029a17
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11029a0e
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11029a69
cmp byte [0x110c6683], 0
je 0x11029a3a
test byte [0x110c66ec], 1
je 0x11029a3a
push 1
mov edx, 1
mov ecx, str.Applying_dialogue_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 1
push 0x446848
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov byte [0x446848], 0x31
push eax
push dword [esp + 4]
push 1
push 0x446848
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x11029a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11029b09
lea ecx, [esp]
push ecx
push str.AlwaysReloadMsgs
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11029b09
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11029aae
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11029b09
cmp byte [0x110c6683], 0
je 0x11029ada
test byte [0x110c66ec], 1
je 0x11029ada
push 1
mov edx, 1
mov ecx, str.Applying_always_reload_messages_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 1
push 0x4a6b8d
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov byte [0x4a6b8d], 0
push eax
push dword [esp + 4]
push 1
push 0x4a6b8d
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x11029b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11029bb1
lea ecx, [esp]
push ecx
push str.EnableMusicInDialogue
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11029bb1
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11029b52
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11029bb1
cmp byte [0x110c6683], 0
je 0x11029b7e
test byte [0x110c66ec], 1
je 0x11029b7e
push 1
mov edx, 1
mov ecx, str.Applying_music_in_dialogue_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 2
push 0x44525a
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x9090
mov word [0x44525a], ax
lea eax, [esp]
push eax
push dword [esp + 4]
push 2
push 0x44525a
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x11029bc0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x14
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11029c09
lea ecx, [esp + 4]
push ecx
push str.PipBoyAvailableAtGameStart
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11029c09
mov ecx, dword [esp + 4]
cmp dword [ecx + 0x14], 0x10
jb 0x11029c02
mov ecx, dword [ecx]
call fcn.11011f90
jmp 0x11029c0b
xor eax, eax
sub eax, 1
je 0x11029c4a
sub eax, 1
jne 0x11029c70
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x497011
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
mov byte [0x497011], 0xeb
push eax
push dword [esp + 8]
push 1
push 0x497011
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x14
ret
sub esp, 0x28
mov ecx, 0x110e5124
mov eax, esp
mov dword [eax], 0x110b5354
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.110053e0
lea ecx, [esp + 8]
call fcn.110052a0
add esp, 0x14
ret
Function at 0x11029d30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp byte [0x110c6683], 0
je 0x11029d54
test byte [0x110c66ec], 1
je 0x11029d54
push 1
mov edx, 1
mov ecx, str.Applying_display_second_weapon_range_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 4
push 0x472202
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x110284a0
sub eax, 0x472206
mov dword [0x472202], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x472202
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x11029d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
cmp byte [0x110c6683], 0
push esi
je 0x11029db7
test byte [0x110c66ec], 1
je 0x11029db7
push 1
mov edx, 1
mov ecx, str.Applying_keep_selected_attack_mode_patch.
call fcn.11011060
push 1
push 0x110285f0
mov edx, 0x4714ec
mov cl, 0xe8
call fcn.1100fb30
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x45f019
call esi
mov eax, 0x11028610
mov byte [0x45f019], 0xe8
sub eax, 0x45f01e
mov dword [0x45f01a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x45f019
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x45f380
call esi
mov eax, 0x11028720
mov byte [0x45f380], 0xe8
sub eax, 0x45f385
mov dword [0x45f381], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x45f380
call esi
pop esi
add esp, 8
ret

Function at 0x11029e50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x11029efa
lea ecx, [esp + 8]
push ecx
push str.PartyMemberSkillFix
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11029efa
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11029e9d
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11029efa
cmp byte [0x110c6683], 0
je 0x11029ec9
test byte [0x110c66ec], 1
je 0x11029ec9
push 1
mov edx, 1
mov ecx, str.Applying_First_Aid_Doctor_skill_use_patch_for_party_members.
call fcn.11011060
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x412837
call esi
mov eax, 0x11028730
sub eax, 0x41283b
mov dword [0x412837], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x412837
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4128f3
call esi
lea eax, [esp + 8]
mov dword [0x4128f3], 0x90909090
push eax
push dword [esp + 0xc]
push 4
push 0x4128f3
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x4128f7
call esi
mov eax, 0xfe39
mov word [0x4128f7], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x4128f7
call esi
pop esi
add esp, 8
ret
Function at 0x11029f60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x4c
push esi
push edi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1102a138
lea ecx, [esp + 0xc]
push ecx
push str.SkipLoadingGameSettings
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x1102a138
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x14], 0x10
jb 0x11029fac
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
test edi, edi
je 0x1102a138
cmp byte [0x110c6683], 0
je 0x11029fde
test byte [0x110c66ec], 1
je 0x11029fde
push 1
mov edx, 1
mov ecx, str.Applying_skip_loading_game_settings_from_a_saved_game_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x493421
call esi
lea eax, [esp + 0xc]
mov dword [0x493421], 0x441f0f
push eax
push dword [esp + 0x10]
push 4
push 0x493421
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x4935a8
call esi
lea eax, [esp + 0xc]
mov byte [0x4935a8], 0x1f
push eax
push dword [esp + 0x10]
push 1
push 0x4935a8
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x4935ab
call esi
lea eax, [esp + 0xc]
mov dword [0x4935ab], 0x90901b75
push eax
push dword [esp + 0x10]
push 4
push 0x4935ab
call esi
cmp edi, 2
jne 0x1102a09d
mov ecx, dword [0x110b2c8c]
sub esp, 8
mov dl, byte [0x110b2c90]
mov eax, esp
mov dword [esp + 0x14], 0x49341c
mov dword [esp + 0x18], 0x49343b
mov dword [eax], ecx
lea ecx, [esp + 0x14]
mov byte [eax + 4], dl
lea edx, [esp + 0x1c]
call fcn.1102b0e0
mov ecx, dword [0x110b2c8c]
sub esp, 8
mov dl, byte [0x110b2c90]
mov eax, esp
mov dword [esp + 0x1c], 0x493450
mov dword [esp + 0x20], 0x493465
mov dword [esp + 0x24], 0x49347a
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
mov byte [eax + 4], dl
lea edx, [esp + 0x58]
mov dword [esp + 0x28], 0x49348f
mov dword [esp + 0x2c], 0x4934a4
mov dword [esp + 0x30], 0x4934b9
mov dword [esp + 0x34], 0x4934ce
mov dword [esp + 0x38], 0x4934e3
mov dword [esp + 0x3c], 0x4934f8
mov dword [esp + 0x40], 0x49350d
mov dword [esp + 0x44], 0x493522
mov dword [esp + 0x48], 0x493547
mov dword [esp + 0x4c], 0x493558
mov dword [esp + 0x50], 0x493569
mov dword [esp + 0x54], 0x49357a
call fcn.1102b0e0
pop edi
pop esi
add esp, 0x4c
ret
Function at 0x1102a200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1102a307
lea ecx, [esp + 8]
push ecx
push str.Fallout1Behavior
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x1102a307
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x1102a24b
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x1102a307
cmp byte [0x110c6683], 0
je 0x1102a27b
test byte [0x110c66ec], 1
je 0x1102a27b
push 1
mov edx, 1
mov ecx, str.Applying_Fallout_1_engine_behavior_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4a4343
call esi
lea eax, [esp + 8]
mov dword [0x4a4343], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x4a4343
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x477c71
call esi
lea eax, [esp + 8]
mov byte [0x477c71], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x477c71
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43f873
call esi
mov eax, 0x11028750
sub eax, 0x43f877
mov dword [0x43f873], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43f873
call esi
pop esi
add esp, 8
ret

Function at 0x1102a3b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c58fc
call esi
mov eax, 0x1102a310
sub eax, 0x4c5900
mov dword [0x4c58fc], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4c58fc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x482ba1
call esi
mov eax, 0x1102a350
sub eax, 0x482ba5
mov dword [0x482ba1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x482ba1
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c599a
call esi
mov eax, 0x1102a3a0
sub eax, 0x4c599e
mov dword [0x4c599a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4c599a
call esi
sub esp, 0x28
mov ecx, 0x110e5118
mov eax, esp
mov dword [eax], 0x110b5384
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.110053e0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1102a4a4
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
pop esi
add esp, 0x10
ret