joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11044b20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push str..ddraw.ini
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11044bb5
lea ecx, [esp]
push ecx
push str.DontDeleteProtos
push str.Debugging
mov ecx, eax
call fcn.11003200
test al, al
je 0x11044bb5
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11044b5a
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
je 0x11044bb5
cmp byte [0x110c6683], 0
je 0x11044b86
test byte [0x110c66ec], 1
je 0x11044b86
push 1
mov edx, 1
mov ecx, str.Applying_permanent_protos_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 1
push 0x48007e
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov byte [0x48007e], 0xeb
push eax
push dword [esp + 4]
push 1
push 0x48007e
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x11045330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43ef84
call esi
mov eax, 0x11044f80
sub eax, 0x43ef88
mov dword [0x43ef84], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43ef84
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f142
call esi
mov eax, 0x11044fa0
sub eax, 0x43f146
mov dword [0x43f142], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43f142
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x43ef76
call esi
lea eax, [esp + 4]
mov byte [0x43ef76], 0x32
push eax
push dword [esp + 8]
push 1
push 0x43ef76
call esi
lea eax, [esp + 0x10]
mov dword [esp + 4], 0x43efa4
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x43efb9
mov ecx, 0x110d6788
mov dword [esp + 0x10], 0x43f2fc
call fcn.1100f980
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x43efea
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x43f315
mov ecx, 0x110d6790
call fcn.1100f980
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f309
call esi
lea eax, [esp + 4]
mov dword [0x43f309], 0x110d678c
push eax
push dword [esp + 8]
push 4
push 0x43f309
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f438
call esi
mov dword [0x43f438], 0x110d65f8
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43f438
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f475
call esi
lea eax, [esp + 4]
mov dword [0x43f475], 0x110d65fc
push eax
push dword [esp + 8]
push 4
push 0x43f475
call esi
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x43f65e
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x43f6bb
mov ecx, 0x110d6530
call fcn.1100f980
push 2
push 0x11044fc0
mov edx, 0x43f05d
mov cl, 0xe8
call fcn.1100fb30
push 2
push 0x11044fe0
mov edx, 0x43f184
mov cl, 0xe8
call fcn.1100fb30
push 2
push 0x11045000
mov edx, 0x43f1e4
mov cl, 0xe8
call fcn.1100fb30
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x11045810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49bcc7
call esi
mov eax, 0x11045760
mov byte [0x49bcc7], 0xe8
sub eax, 0x49bccc
mov dword [0x49bcc8], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49bcc7
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49bd56
call esi
mov eax, 0x11045780
mov byte [0x49bd56], 0xe8
sub eax, 0x49bd5b
mov dword [0x49bd57], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49bd56
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2865
call esi
mov eax, 0x110457a0
mov byte [0x4a2865], 0xe8
sub eax, 0x4a286a
mov dword [0x4a2866], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2865
call esi
push 1
push 0x110457d0
mov edx, 0x4737f2
mov cl, 0xe8
call fcn.1100fb30
push 1
push 0x110457f0
mov edx, 0x49c005
mov cl, 0xe8
call fcn.1100fb30
pop esi
pop ecx
ret

Function at 0x11045a20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x479183
mov ebx, edx
mov esi, ecx
call edi
lea eax, [esp + 0xc]
mov dword [0x479183], esi
push eax
push dword [esp + 0x10]
push 4
push 0x479183
call edi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x47918b
call edi
lea eax, [esp + 0xc]
mov dword [0x47918b], ebx
push eax
push dword [esp + 0x10]
push 4
push 0x47918b
call edi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x11045a90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
mov byte [0x110d651b], 1
push esi
push edi
mov edi, edx
cmp ecx, 0x33
je 0x11045b09
cmp ecx, 0x55
jne 0x11045b62
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4a2884
call esi
lea eax, [esp + 8]
mov dword [0x4a2884], edi
push eax
push dword [esp + 0xc]
push 4
push 0x4a2884
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4a287f
call esi
mov eax, dword [esp + 0x10]
mov dword [0x4a287f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4a287f
call esi
pop edi
pop esi
pop ecx
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4a2878
call esi
lea eax, [esp + 8]
mov dword [0x4a2878], edi
push eax
push dword [esp + 0xc]
push 4
push 0x4a2878
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4a2873
call esi
mov eax, dword [esp + 0x10]
mov dword [0x4a2873], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4a2873
call esi
pop edi
pop esi
pop ecx
ret 4
Function at 0x11045f60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp dword [0x110c0bc0], 2
jne 0x11045f73
cmp dword [0x110c0b5c], 3
je 0x11045fd3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x479183
call esi
lea eax, [esp + 4]
mov dword [0x479183], 2
push eax
push dword [esp + 8]
push 4
push 0x479183
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47918b
call esi
lea eax, [esp + 4]
mov dword [0x47918b], 3
push eax
push dword [esp + 8]
push 4
push 0x47918b
call esi
pop esi
pop ecx
ret

Function at 0x11046570
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x110e5888]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x110e5894]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x110e5880]
cmp edi, edx
jne 0x110465d0
mov ecx, edx
jmp 0x110465d5
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x110465fa
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x110465e4
mov eax, dword [eax]
jmp 0x110465c8
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8
Function at 0x110466c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1109eb60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x11046741
mov esi, dword [ebx + 4]
jmp 0x11046747
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1104675c
mov ecx, dword [edi]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x110467a3
cmp esi, eax
jne 0x11046750
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1104678c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x110467ea
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1104680c
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
lea ecx, [edi + 0xc]
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.110385f0
push 0x48
mov edx, 1
mov ecx, edi
call fcn.11004ac0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x110467f2
mov dword [ecx], edi
jmp 0x1104680c
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1104680c
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.11046850
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110468e0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1104694f
cmp dword [ecx], edi
jne 0x11046947
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x11046957
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x11046957
cmp dword [ecx], edi
jne 0x1104695b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
lea ecx, [edi + 0xc]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.110385f0
push 0x48
mov edx, 1
mov ecx, edi
call fcn.11004ac0
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x11047030
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov edx, dword [0x110e4eb0]
mov eax, 0x3a196b1f
push ebx
push ebp
push esi
push edi
mov edi, dword [0x110e4eac]
mov ebx, ecx
sub edx, edi
mov dword [esp + 0x18], ebx
imul edx
xor esi, esi
sar edx, 5
mov ecx, edx
mov dword [esp + 0x10], esi
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x110d71b4]
cmp edx, ecx
jae 0x11047093
imul eax, edx, 0x8d
add eax, edi
sub ecx, edx
cmp byte [eax + 0x8c], 0
je 0x11047089
cmp dword [eax], 0
je 0x11047089
inc esi
mov dword [esp + 0x10], esi
add eax, 0x8d
sub ecx, 1
jne 0x11047076
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [0x110e4eb0]
mov eax, 0x3a196b1f
mov edi, dword [0x110e4eac]
mov ecx, ebp
mov ebx, dword [0x110d71b4]
sub ecx, edi
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x11047151
imul esi, ebx, 0x8d
lea esp, [esp]
cmp byte [esi + edi + 0x8c], 0
je 0x11047131
cmp dword [esi + edi], 0
je 0x11047131
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [edi + 4]
mov edi, dword [esp + 0x20]
push 0x88
add eax, esi
push eax
push edi
call ebp
mov eax, dword [0x110e4eac]
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esi + eax + 4]
push dword [esi + eax]
push edi
call ebp
mov ebp, dword [0x110e4eb0]
mov edi, dword [0x110e4eac]
mov ecx, ebp
mov eax, 0x3a196b1f
sub ecx, edi
inc ebx
imul ecx
add esi, 0x8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x110470e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1104db20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp byte [0x110d71ed], 0
mov dword [0x110f69c4], ecx
jne 0x1104db75
lea eax, [esp]
push eax
push 0x40
push 5
push 0x46e80b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1104db00
mov byte [0x46e80b], 0xe9
sub eax, 0x46e810
mov dword [0x46e80c], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x46e80b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x110d71ed], 1
pop ecx
ret

Function at 0x1104f250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110f6972], 0
push esi
push edi
jne 0x1104f29a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x478ec7
call esi
mov eax, 0x1104f220
sub eax, 0x478ecb
mov dword [0x478ec7], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x478ec7
call esi
mov byte [0x110f6972], 1
mov edx, dword [0x110e50e0]
xor esi, esi
mov ecx, dword [0x110e50dc]
mov eax, edx
mov edi, dword [esp + 0x10]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1104f2f1
cmp dword [ecx + esi*4], edi
lea eax, [ecx + esi*4]
jne 0x1104f2e5
lea ecx, [eax + 4]
dec esi
sub edx, ecx
push edx
push ecx
push eax
call fcn.11080290
mov edx, dword [0x110e50e0]
add esp, 0xc
mov ecx, dword [0x110e50dc]
sub edx, 4
mov dword [0x110e50e0], edx
mov eax, edx
inc esi
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x1104f2b7
mov ecx, dword [0x110e50d4]
xor eax, eax
mov edx, dword [0x110e50d0]
mov esi, ecx
sub esi, edx
sar esi, 2
test esi, esi
je 0x1104f31a
lea ebx, [ebx]
cmp dword [edx + eax*4], edi
je 0x1104f385
inc eax
cmp eax, esi
jb 0x1104f310
lea eax, [esp + 0x10]
cmp eax, ecx
jae 0x1104f357
cmp edx, eax
ja 0x1104f357
mov esi, eax
sub esi, edx
sar esi, 2
cmp ecx, dword [0x110e50d8]
jne 0x1104f34c
push ecx
mov ecx, 0x110e50d0
call fcn.11036db0
mov ecx, dword [0x110e50d4]
mov edx, dword [0x110e50d0]
test ecx, ecx
je 0x1104f37c
mov eax, dword [edx + esi*4]
mov dword [ecx], eax
jmp 0x1104f376
cmp ecx, dword [0x110e50d8]
jne 0x1104f370
push ecx
mov ecx, 0x110e50d0
call fcn.11036db0
mov ecx, dword [0x110e50d4]
test ecx, ecx
je 0x1104f37c
mov dword [ecx], edi
mov ecx, dword [0x110e50d4]
add ecx, 4
mov dword [0x110e50d4], ecx
pop edi
pop esi
pop ecx
ret 4
Function at 0x1104f390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110f6972], 0
push esi
push edi
jne 0x1104f3da
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x478ec7
call esi
mov eax, 0x1104f220
sub eax, 0x478ecb
mov dword [0x478ec7], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x478ec7
call esi
mov byte [0x110f6972], 1
mov edx, dword [0x110e50d4]
xor esi, esi
mov ecx, dword [0x110e50d0]
mov eax, edx
mov edi, dword [esp + 0x10]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1104f431
cmp dword [ecx + esi*4], edi
lea eax, [ecx + esi*4]
jne 0x1104f425
lea ecx, [eax + 4]
dec esi
sub edx, ecx
push edx
push ecx
push eax
call fcn.11080290
mov edx, dword [0x110e50d4]
add esp, 0xc
mov ecx, dword [0x110e50d0]
sub edx, 4
mov dword [0x110e50d4], edx
mov eax, edx
inc esi
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x1104f3f7
mov ecx, dword [0x110e50e0]
xor eax, eax
mov edx, dword [0x110e50dc]
mov esi, ecx
sub esi, edx
sar esi, 2
test esi, esi
je 0x1104f45a
lea ebx, [ebx]
cmp dword [edx + eax*4], edi
je 0x1104f4c5
inc eax
cmp eax, esi
jb 0x1104f450
lea eax, [esp + 0x10]
cmp eax, ecx
jae 0x1104f497
cmp edx, eax
ja 0x1104f497
mov esi, eax
sub esi, edx
sar esi, 2
cmp ecx, dword [0x110e50e4]
jne 0x1104f48c
push ecx
mov ecx, 0x110e50dc
call fcn.11036db0
mov ecx, dword [0x110e50e0]
mov edx, dword [0x110e50dc]
test ecx, ecx
je 0x1104f4bc
mov eax, dword [edx + esi*4]
mov dword [ecx], eax
jmp 0x1104f4b6
cmp ecx, dword [0x110e50e4]
jne 0x1104f4b0
push ecx
mov ecx, 0x110e50dc
call fcn.11036db0
mov ecx, dword [0x110e50e0]
test ecx, ecx
je 0x1104f4bc
mov dword [ecx], edi
mov ecx, dword [0x110e50e0]
add ecx, 4
mov dword [0x110e50e0], ecx
pop edi
pop esi
pop ecx
ret 4

Function at 0x1104f860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
cmp byte [0x110c6683], 0
push esi
je 0x1104f887
test byte [0x110c66ec], 1
je 0x1104f887
push 1
mov edx, 1
mov ecx, str.Applying_Rays_combat_p_proc_patch.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x424dd9
call esi
mov eax, 0x1104f850
mov byte [0x424dd9], 0xe8
sub eax, 0x424dde
mov dword [0x424dda], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x424dd9
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x424dc6
call esi
mov eax, 0x9090
mov word [0x424dc6], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x424dc6
call esi
pop esi
add esp, 8
ret
Function at 0x110500c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x110c09f0]
sub esp, 0x110
mov ecx, dword [eax]
mov eax, dword [0x110e3e04]
push ebx
push esi
push edi
inc eax
push 0x110b7a00
add eax, ecx
push eax
push dword [0x5193cc]
lea eax, [ebp - 0x110]
push str._s_savegame_slot_.2d_sfall_s.sav
push eax
call fcn.11011d70
lea eax, [ebp - 0x110]
push eax
push 0
push str.Saving_game:__s_n
call fcn.1100ff40
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [ebp - 0x110]
add esp, 0x20
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x11050293
mov ecx, esi
call fcn.11034f40
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push 0
push eax
push 4
push 0x110c0b2c
push esi
call ebx
mov eax, dword [0x110c694c]
shl eax, 0x10
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push esi
call ebx
mov ecx, esi
call fcn.11059d70
mov ecx, esi
call fcn.11075790
mov ecx, esi
call fcn.11039e60
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov eax, dword [0x110c09f0]
push 0x110b8230
mov ecx, dword [eax]
mov eax, dword [0x110e3e04]
inc eax
add eax, ecx
push eax
push dword [0x5193cc]
lea eax, [ebp - 0x110]
push str._s_savegame_slot_.2d_sfall_s.sav
push eax
call fcn.11011d70
add esp, 0x14
lea eax, [ebp - 0x110]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x11050293
mov ecx, esi
call fcn.110323c0
mov ecx, esi
call fcn.11020960
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x404cc
push eax
push 4
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
mov ecx, dword [0x110e4eb0]
mov eax, 0x3a196b1f
sub ecx, dword [0x110e4eac]
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, dword [0x110d71b4]
test eax, eax
jle 0x110502d3
mov eax, dword [0x110c09f0]
push 0x110b794c
mov ecx, dword [eax]
mov eax, dword [0x110e3e04]
inc eax
add eax, ecx
push eax
push dword [0x5193cc]
lea eax, [ebp - 0x110]
push str._s_savegame_slot_.2d_sfall_s.sav
push eax
call fcn.11011d70
add esp, 0x14
lea eax, [ebp - 0x110]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x11050293
mov ecx, esi
call fcn.11047030
push esi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x110]
push eax
push 0
push str.ERROR_creating:__s_n
call fcn.1100ff40
add esp, 0xc
mov eax, 0x110e44d4
cmp dword [0x110e44e8], 0x10
cmovae eax, dword [0x110e44d4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call dword [0x110af5e0]
mov eax, str.IISXXXX1
call dword [0x110af4f0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x11052850
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x110528bf
cmp dword [ecx], edi
jne 0x110528b7
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x110528c7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x110528c7
cmp dword [ecx], edi
jne 0x110528cb
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x110528ef
push 8
push eax
call fcn.1107e2c3
add esp, 8
push 0x10
mov edx, 1
mov ecx, edi
call fcn.11004ac0
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x11052990
Capabilities:
Hash data using fnv

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [0x110e5190]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
push esi
mov esi, dword [0x110e5188]
push edi
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x110e519c]
and ecx, eax
mov eax, dword [ebp + ecx*8]
add ecx, ecx
lea ebx, [ecx*4]
mov edi, dword [ebx + ebp]
lea ecx, [ecx*4 + 4]
mov dword [esp + 0x1c], ecx
lea ebx, [ebx]
cmp edi, esi
jne 0x11052a08
mov ecx, esi
jmp 0x11052a0d
mov ecx, dword [ecx + ebp]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x11052a65
mov ecx, dword [eax + 8]
cmp ecx, dword [edx]
je 0x11052a20
mov eax, dword [eax]
mov ecx, dword [esp + 0x1c]
jmp 0x11052a00
mov ebx, dword [edx]
mov ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1c]
lea esp, [esp]
cmp edi, esi
jne 0x11052a38
mov edx, esi
jmp 0x11052a3d
mov edx, dword [ecx + ebp]
mov edx, dword [edx]
cmp eax, edx
je 0x11052a4a
cmp ebx, dword [eax + 8]
jne 0x11052a4a
mov eax, dword [eax]
jmp 0x11052a30
mov ecx, dword [esp + 0x10]
cmp ecx, eax
je 0x11052a65
mov edx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [edx + 4], eax
mov eax, edx
mov dword [edx], ecx
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8