joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1100f550
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x104
sub ecx, 0
je 0x1100f75d
sub ecx, 1
jne 0x1100f76d
push 0xfa
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
add ecx, eax
mov eax, dword [0x110b3584]
mov dword [ecx], eax
mov eax, dword [0x110b3588]
mov dword [ecx + 4], eax
mov ax, word [0x110b358c]
mov word [ecx + 8], ax
mov al, byte [0x110b358e]
mov byte [ecx + 0xa], al
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x110c668c], eax
test eax, eax
je 0x1100f76d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x110b3590
push eax
call esi
push 0x110b35a4
push dword [0x110c668c]
mov dword [0x110c669c], eax
call esi
push 0x110b35b4
push dword [0x110c668c]
mov dword [0x110c66a4], eax
call esi
push 0x110b35d0
push dword [0x110c668c]
mov dword [0x110c66a8], eax
call esi
push 0x110b35e8
push dword [0x110c668c]
mov dword [0x110c66ac], eax
call esi
push 0x110b3600
push dword [0x110c668c]
mov dword [0x110c66b0], eax
call esi
push 0x110b3610
push dword [0x110c668c]
mov dword [0x110c66b4], eax
call esi
push 0x110b3624
push dword [0x110c668c]
mov dword [0x110c66b8], eax
call esi
push 0x110b3630
push dword [0x110c668c]
mov dword [0x110c66bc], eax
call esi
push 0x110b3648
push dword [0x110c668c]
mov dword [0x110c66c0], eax
call esi
push 0x110b365c
push dword [0x110c668c]
mov dword [0x110c6694], eax
call esi
push 0x110b3670
push dword [0x110c668c]
mov dword [0x110c6698], eax
call esi
push 0x110b3688
push dword [0x110c668c]
mov dword [0x110c66c4], eax
call esi
push 0x110b36a0
push dword [0x110c668c]
mov dword [0x110c6690], eax
call esi
push 0x110b36b8
push dword [0x110c668c]
mov dword [0x110c66c8], eax
call esi
push 0x110b36d0
push dword [0x110c668c]
mov dword [0x110c66cc], eax
call esi
push 0x110b36e0
push dword [0x110c668c]
mov dword [0x110c66d0], eax
call esi
push 0x110b36f4
push dword [0x110c668c]
mov dword [0x110c66d4], eax
call esi
push 0x110b3708
push dword [0x110c668c]
mov dword [0x110c66d8], eax
call esi
push 0x110b3718
push dword [0x110c668c]
mov dword [0x110c66dc], eax
call esi
push 0x110b372c
push dword [0x110c668c]
mov dword [0x110c66e0], eax
call esi
push 0x110b3740
push dword [0x110c668c]
mov dword [0x110c66e4], eax
call esi
push 0x110b3754
push dword [0x110c668c]
mov dword [0x110c66a0], eax
call esi
mov dword [0x110c66e8], eax
pop esi
add esp, 0x104
ret
mov eax, dword [0x110c668c]
test eax, eax
je 0x1100f76d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esp, 0x104
ret
Function at 0x1100f780
Capabilities:
Allocate or change rwx memory

Disassembly:
mov ecx, dword [esp + 8]
cmp ecx, 1
jne 0x1100f7ef
push 0xe
push str.FALLOUT_Mapper
push 0x53c938
call fcn.1108a320
add esp, 0xc
test eax, eax
je 0x1100f7f4
mov eax, dword [esp + 4]
mov dword [0x110c6688], eax
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4de8de
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1100f040
mov byte [0x4de8de], 0xe8
sub eax, 0x4de8e3
mov dword [0x4de8df], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4de8de
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
ret 0xc
call fcn.1100f550
mov al, 1
ret 0xc

Function at 0x1100f980
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, edx
mov dword [esp + 0xc], ecx
sub ebp, edi
xor ecx, ecx
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x14]
cmova ebp, ecx
test ebp, ebp
je 0x1100f9d9
push esi
mov esi, dword [edi]
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
mov dword [esi], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x1100f9a6
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x1100fb30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov bl, cl
lea ecx, [esp + 0x1c]
mov ebp, edx
push ecx
push 0x40
lea eax, [edi + 5]
push eax
push ebp
mov dword [esp + 0x20], eax
lea esi, [ebp + 5]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
sub eax, esi
mov byte [ebp], bl
mov dword [ebp + 1], eax
mov byte [esi], 0x90
lea esi, [esi + 1]
sub edi, 1
jne 0x1100fb62
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x1100fb90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret 8

Function at 0x1100fbd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [esp + 0x10]
mov word [edi], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret 8
Function at 0x1100fc10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
mov dword [edi], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret 8

Function at 0x1100fc50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [edx + 1]
jmp 0x1100fc60
mov al, byte [edx]
inc edx
test al, al
jne 0x1100fc60
sub edx, ecx
lea eax, [esp + 0xc]
push eax
push 0x40
lea ebx, [edx + 1]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, edi
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x1100fc80
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1100fcb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push 0x40
push 4
lea ebp, [esi + 1]
mov ebx, edx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
sub ebx, esi
push eax
push dword [esp + 0x10]
sub ebx, 5
push 4
push ebp
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1100fcf0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
sub ebx, ebp
add ebx, 3
mov dword [esp + 0x10], ecx
shr ebx, 2
xor ecx, ecx
cmp ebp, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
cmova ebx, ecx
test ebx, ebx
je 0x1100fd65
push esi
push edi
mov esi, dword [ebp]
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
lea edi, [esi + 1]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
sub eax, esi
sub eax, 5
mov dword [edi], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x14]
lea ebp, [ebp + 4]
inc eax
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x1100fd20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x1100fd70
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
sub ebx, edi
mov dword [esp + 0x10], ecx
add ebx, 3
xor ecx, ecx
shr ebx, 2
cmp edi, dword [esp + 0x1c]
cmova ebx, ecx
test ebx, ebx
je 0x1100fddc
push esi
lea ebx, [ebx]
mov esi, dword [edi]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x14]
sub eax, esi
mov byte [esi], 0xe8
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebp
lea edi, [edi + 4]
cmp ebp, ebx
jne 0x1100fda0
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x1100fdf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
xor ecx, ecx
push ebp
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, dword [esp + 0x18]
cmova edi, ecx
test edi, edi
je 0x1100fe51
push esi
mov esi, dword [ebx]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11065ab0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebp
lea ebx, [ebx + 4]
cmp ebp, edi
jne 0x1100fe14
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x11010c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1109e1a8
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x11010d4a
cmp byte [ebx + 0x3d], 0
je 0x11010d4a
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x11010c68
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.11009860
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebx + 0x38]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
mov edx, dword [ecx]
cmovae edi, dword [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x11010cce
sub eax, 1
je 0x11010cd2
mov edx, dword [ebp - 0x14]
sub eax, 2
je 0x11010d25
xor bl, bl
jmp 0x11010d27
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x10]
cmovae eax, ecx
sub esi, eax
je 0x11010d07
push dword [ebx + 0x4c]
cmp edx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.1108b15a
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x11010cca
cmp byte [ebx + 0x3d], 0
je 0x11010d25
test esi, esi
jne 0x11010c90
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.11009fb0
jmp 0x11010c8d
mov bl, 1
cmp edx, 0x10
jb 0x11010d37
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.11004ac0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11011ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xa8
mov ax, word [0x110b2cac]
mov word [esp], ax
mov al, byte [0x110b2cae]
push 0x40
mov byte [esp + 6], al
lea eax, [esp + 7]
push 0
push eax
call fcn.110816e0
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x110c66f0]
lea eax, [eax + 1]
mov byte [esp + eax + 1], cl
test cl, cl
jne 0x11011af0
lea eax, [esp]
mov edx, str.language
push eax
push 0x20
lea eax, [esp + 0x4c]
mov ecx, str.system
push eax
push str.english
call fcn.1100a410
lea eax, [esp]
mov edx, str.master_patches
push eax
push 0x41
lea eax, [esp + 0x6c]
mov ecx, str.system
push eax
push str.data
call fcn.1100a410
mov ecx, 0x110e43e8
mov al, byte [ecx]
cmp al, 0x5c
je 0x11011b52
cmp al, 0x2f
je 0x11011b52
cmp al, 0x2e
jne 0x11011b55
inc ecx
jmp 0x11011b44
push ecx
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x6c]
push eax
push str._s_text_s_s
push 0x110e4429
call fcn.11011d70
add esp, 0x14
push 0x110e4429
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne byte [0x110e44d3]
add esp, 0xa8
ret
Function at 0x110135d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4de9fc
call esi
mov eax, 0x11012d30
mov byte [0x4de9fc], 0xe9
sub eax, 0x4dea01
mov dword [0x4de9fd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4de9fc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c9bd9
call esi
lea eax, [esp + 4]
mov dword [0x4c9bd9], 0x11013060
push eax
push dword [esp + 8]
push 4
push 0x4c9bd9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481b2b
call esi
mov eax, 0x11013170
sub eax, 0x481b2f
mov dword [0x481b2b], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x481b2b
call esi
pop esi
pop ecx
ret

Function at 0x11015860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x428480
call esi
mov eax, 0x11015840
mov byte [0x428480], 0xe9
sub eax, 0x428485
mov dword [0x428481], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x428480
call esi
push 6
push 0x11015850
mov edx, 0x429bde
mov cl, 0xe8
call fcn.1100fb30
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x429be9
call esi
lea eax, [esp + 8]
mov byte [0x429be9], 0x75
push eax
push dword [esp + 0xc]
push 1
push 0x429be9
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x429bf1
call esi
lea eax, [esp + 8]
mov byte [0x429bf1], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x429bf1
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1101594d
lea ecx, [esp + 8]
push ecx
push str.AIDrugUsePerfFix
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x1101594d
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11015946
mov ecx, dword [ecx]
call fcn.11011f90
jmp 0x1101594f
xor eax, eax
mov dword [0x110e5904], eax
test eax, eax
jle 0x1101597b
cmp byte [0x110c6683], 0
je 0x1101597b
test byte [0x110c66ec], 0x10
je 0x1101597b
push 1
mov edx, 0x10
mov ecx, str.Applying_AI_drug_use_preference_fix.
call fcn.11011060
pop esi
add esp, 8
ret
Function at 0x110160d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x429a09
call esi
mov eax, 0x11015fd0
sub eax, 0x429a0d
mov dword [0x429a09], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x429a09
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478b25
call esi
mov eax, 0x110160a0
mov byte [0x478b25], 0xe9
sub eax, 0x478b2a
mov dword [0x478b26], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478b25
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4786a0
call esi
mov eax, 0x110160c0
mov byte [0x4786a0], 0xe9
sub eax, 0x4786a5
mov dword [0x4786a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4786a0
call esi
pop esi
pop ecx
ret

Function at 0x11016570
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4b3c7c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11016560
mov byte [0x4b3c7c], 0xe9
sub eax, 0x4b3c81
mov dword [0x4b3c7d], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4b3c7c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110165fc
lea ecx, [esp]
push ecx
push str.SmallFrameFix
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x110165fc
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x110165ec
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
setne byte [0x110c6733]
pop ecx
ret
xor eax, eax
test eax, eax
setne byte [0x110c6733]
pop ecx
ret

Function at 0x11016ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110c6738], 0
push esi
mov esi, ecx
mov dword [0x110c0ab0], esi
jne 0x11016cfb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x415efc
mov byte [0x110c6738], 1
call esi
mov eax, 0x11016c80
mov byte [0x415efc], 0xe9
sub eax, 0x415f01
mov dword [0x415efd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x415efc
call esi
pop esi
pop ecx
ret
push esi
mov ecx, 0x110e432c
call fcn.11016d90
push esi
mov ecx, 0x110e452c
call fcn.11016d90
pop esi
pop ecx
ret

Function at 0x11016d20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4b1b85
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x110168a0
mov byte [0x4b1b85], 0xe9
sub eax, 0x4b1b8a
mov dword [0x4b1b86], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4b1b85
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x110c0ab0]
mov ecx, 0x110e432c
call fcn.11016d90
push dword [0x110c0ab0]
mov ecx, 0x110e452c
call fcn.11016d90
pop ecx
ret
Function at 0x11017560
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4d36d4
call esi
mov eax, fcn.11014720
mov byte [0x4d36d4], 0xe9
sub eax, 0x4d36d9
mov dword [0x4d36d5], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4d36d4
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4d3704
call esi
mov eax, fcn.110147f0
mov byte [0x4d3704], 0xe9
sub eax, 0x4d3709
mov dword [0x4d3705], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4d3704
call esi
push 1
push 0x11017550
mov edx, 0x4d6fd9
mov cl, 0xe9
call fcn.1100fb30
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4c8fd1
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x4c900d
mov ecx, 0x51e3fc
call fcn.1100f980
pop esi
add esp, 0x10
ret

Function at 0x110178b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
cmp byte [0x110c6682], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, 0x11017830
jne 0x1101791e
cmp byte [0x110e58bf], 0
je 0x1101790c
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x43186c
call esi
mov eax, 0x11017820
mov byte [0x43186c], 0xe9
sub eax, 0x431871
mov dword [0x43186d], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x43186c
call esi
jmp 0x11017923
cmp dword [0x110c6744], 0
je 0x11017923
cmp byte [0x110c673b], 0
jne 0x11017923
mov edi, 0x110178a0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x46ed87
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x49ad7a
mov ecx, edi
call fcn.1100f980
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x472f9a
call esi
lea eax, [esp + 8]
mov dword [0x472f9a], 0x11017890
push eax
push dword [esp + 0xc]
push 4
push 0x472f9a
call esi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x11017aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
lea eax, [esp + 8]
mov dword [esp], 0x4a7496
lea ecx, [esp]
mov dword [esp + 4], 0x432de8
push eax
push ecx
mov ecx, 0x110179f0
call fcn.1100fcf0
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 0x436c8e
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0x437045
push eax
push ecx
mov ecx, 0x11017a00
mov dword [esp + 0x1c], 0x43769b
mov dword [esp + 0x20], 0x43800a
mov dword [esp + 0x24], 0x43c580
mov dword [esp + 0x28], 0x41e027
mov dword [esp + 0x2c], 0x41ec22
call fcn.1100fcf0
lea eax, [esp]
push eax
push 0x40
push 4
push 0x41d105
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11017a70
sub eax, 0x41d109
mov dword [0x41d105], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x41d105
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
mov dword [esp], 0x43ae93
lea ecx, [esp]
mov dword [esp + 4], 0x43af59
push eax
push ecx
mov ecx, 0x11017a80
mov dword [esp + 0x10], 0x43cb5c
call fcn.1100fcf0
mov esp, ebp
pop ebp
ret
Function at 0x110181d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4811e2
call edi
mov eax, 0x11017f90
sub eax, 0x4811e6
mov dword [0x4811e2], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4811e2
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x48126a
call edi
mov eax, 0x11017fd0
sub eax, 0x48126e
mov dword [0x48126a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x48126a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x481354
call edi
mov eax, 0x110181b0
sub eax, 0x481358
mov dword [0x481354], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x481354
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x48135d
call edi
lea eax, [esp + 8]
mov dword [0x48135d], esi
push eax
push dword [esp + 0xc]
push 4
push 0x48135d
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x48138e
call edi
lea eax, [esp + 8]
mov dword [0x48138e], esi
push eax
push dword [esp + 0xc]
push 4
push 0x48138e
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x481226
call edi
lea eax, [esp + 8]
mov dword [0x481226], 0xfff97f36
push eax
push dword [esp + 0xc]
push 4
push 0x481226
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x481223
call edi
mov eax, 0xca89
mov word [0x481223], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x481223
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4813c1
call edi
lea eax, [esp + 8]
mov dword [0x4813c1], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x4813c1
call edi
pop edi
pop esi
pop ecx
ret