joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11052be0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1109ec30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x11052c61
mov esi, dword [ebx + 4]
jmp 0x11052c67
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x11052c7c
mov ecx, dword [edi]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x11052cc3
cmp esi, eax
jne 0x11052c70
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x11052cac
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x11052d14
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x11052d36
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x11052cea
push 8
push eax
call fcn.1107e2c3
add esp, 8
push 0x10
mov edx, 1
mov ecx, edi
call fcn.11004ac0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x11052d1c
mov dword [ecx], edi
jmp 0x11052d36
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x11052d36
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.11052d80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x11053700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x663974], 0
jne 0x11053716
cmp dword [0x638e74], 0
jne 0x11053754
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4f5f40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [0x4f5f40], 0xc3
push eax
push dword [ebp - 4]
push 1
push 0x4f5f40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0
call dword [0x110af4fc]
mov dword [0x110d7a50], eax
mov esp, ebp
pop ebp
ret
Function at 0x1105377b
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x110c46c8]
sub esp, 0x20c
push esi
mov esi, ecx
cmp eax, 0xffffffff
jne 0x110537e0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x110a24d8
push 3
push 0
push 0x110b8764
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x110537be
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [0x110c46c8], 0
jmp 0x110537e4
push 1
xor edx, edx
mov ecx, str.Error:_Video_Mixing_Renderer__VMR9__capabilities_are_required.
call fcn.11011060
mov dword [0x110c46c8], 1
xor eax, eax
pop esi
add esp, 0x20c
ret
test eax, eax
jne 0x110537d6
mov edx, dword [0x5193cc]
xor eax, eax
lea esp, [esp]
mov cl, byte [edx + eax]
test cl, cl
je 0x11053860
movsx cx, cl
mov word [esp + eax*2 + 8], cx
mov cl, byte [edx + eax + 1]
test cl, cl
je 0x1105385f
movsx cx, cl
mov word [esp + eax*2 + 0xa], cx
mov cl, byte [edx + eax + 2]
test cl, cl
je 0x1105385a
movsx cx, cl
mov word [esp + eax*2 + 0xc], cx
mov cl, byte [edx + eax + 3]
test cl, cl
je 0x11053855
movsx cx, cl
mov word [esp + eax*2 + 0xe], cx
mov cl, byte [edx + eax + 4]
test cl, cl
je 0x11053850
movsx cx, cl
mov word [esp + eax*2 + 0x10], cx
add eax, 5
cmp eax, 0x104
jl 0x110537f0
jmp 0x11053860
add eax, 4
jmp 0x11053860
add eax, 3
jmp 0x11053860
add eax, 2
jmp 0x11053860
inc eax
lea edx, [eax + 0xa]
cmp edx, 0x104
jge 0x110537d6
lea ecx, [esp + 8]
lea ecx, [ecx + eax*2]
mov eax, dword [str._artcuts_]
mov dword [ecx], eax
mov eax, dword [0x110b8628]
mov dword [ecx + 4], eax
mov eax, dword [0x110b862c]
mov dword [ecx + 8], eax
mov eax, dword [0x110b8630]
mov dword [ecx + 0xc], eax
mov eax, dword [0x110b8634]
mov dword [ecx + 0x10], eax
mov ax, word [0x110b8638]
mov word [ecx + 0x14], ax
mov ecx, dword [esi*4 + 0x110f6a20]
sub ecx, edx
cmp edx, 0x104
jge 0x110537d6
lea esp, [esp]
mov al, byte [ecx + edx]
test al, al
je 0x110538e1
cbw
mov word [esp + edx*2 + 8], ax
inc edx
cmp edx, 0x104
jl 0x110538c0
xor eax, eax
pop esi
add esp, 0x20c
ret
cmp edx, 0x104
jge 0x110537d6
mov eax, dword [0x110b863c]
mov dword [esp + edx*2 + 2], eax
mov eax, dword [0x110b8640]
mov dword [esp + edx*2 + 6], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x110537d6
mov edx, 0x110e51b0
lea ecx, [esp + 8]
call fcn.110533e0
test eax, eax
jne 0x11053936
mov ecx, 0x110e51b0
call fcn.11053360
pop esi
add esp, 0x20c
ret
mov edx, 0x11053760
mov ecx, 0x44e932
call fcn.1100fcb0
mov edx, 0x110536f0
mov ecx, 0x44e949
call fcn.1100fcb0
mov edx, 0x110536e0
mov ecx, 0x44e937
call fcn.1100fcb0
mov eax, dword [0x110e51c8]
push 0x110f6aa0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov dword [0x110f6a1c], 1
mov eax, 1
pop esi
add esp, 0x20c
ret
Function at 0x11053990
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e933
call esi
lea eax, [ebp - 4]
mov dword [0x44e933], 0x39191
push eax
push dword [ebp - 4]
push 4
push 0x44e933
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e938
call esi
lea eax, [ebp - 4]
mov dword [0x44e938], 0x3934c
push eax
push dword [ebp - 4]
push 4
push 0x44e938
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e94a
call esi
lea eax, [ebp - 4]
mov dword [0x44e94a], 0x7a22a
push eax
push dword [ebp - 4]
push 4
push 0x44e94a
call esi
cmp dword [0x663974], 0
jne 0x11053a28
cmp dword [0x638e74], 0
jne 0x11053a68
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4f5f40
call esi
lea eax, [ebp - 4]
mov byte [0x4f5f40], 0x53
push eax
push dword [ebp - 4]
push 1
push 0x4f5f40
call esi
mov eax, dword [0x110d7a50]
test eax, eax
je 0x11053a68
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call dword [0x110af4fc]
mov dword [0x110d7a50], eax
mov ecx, 0x110e51b0
mov dword [0x110f6a1c], 0
call fcn.11053360
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x11053b30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11053c10
lea ecx, [esp + 8]
push ecx
push str.SkipOpeningMovies
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11053c10
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11053b7a
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
test edi, edi
je 0x11053c10
cmp byte [0x110c6683], 0
je 0x11053bac
test byte [0x110c66ec], 1
je 0x11053bac
push 1
mov edx, 1
mov ecx, str.Skipping_opening_movies.
call fcn.11011060
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x4809c7
call esi
mov eax, 0x1ceb
mov word [0x4809c7], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x4809c7
call esi
cmp edi, 2
jne 0x11053c10
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4426a1
call esi
lea eax, [esp + 8]
mov dword [0x4426a1], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x4426a1
call esi
pop edi
pop esi
pop ecx
ret
Function at 0x11053ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11053d78
lea ecx, [esp + 8]
push ecx
push str.AllowDShowMovies
push str.Graphics
mov ecx, eax
call fcn.11003200
test al, al
je 0x11053d78
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11053ceb
mov ecx, dword [ecx]
call fcn.11011f90
test eax, eax
jle 0x11053d78
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 2
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x44e690
setge byte [0x110d6518]
call esi
mov eax, 0x11053a90
mov byte [0x44e690], 0xe9
sub eax, 0x44e695
mov dword [0x44e691], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x44e690
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44e994
call esi
mov eax, 0x11053ad0
sub eax, 0x44e998
mov dword [0x44e994], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44e994
call esi
mov al, 1
pop esi
add esp, 8
ret
xor al, al
pop esi
add esp, 8
ret
Function at 0x11054ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp dword [0x110e51e0], 0
je 0x11054f19
cmp byte [0x110d720d], 0
je 0x11054f19
xor cl, cl
call fcn.11054a20
cmp byte [0x110f6973], 2
jne 0x11054f19
lea eax, [esp]
mov byte [0x110f6973], 1
push eax
push 0x40
push 1
push 0x422bde
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov byte [0x422bde], 1
push eax
push dword [esp + 4]
push 1
push 0x422bde
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x110e5474]
mov dword [0x110e5478], eax
mov eax, dword [0x110e51d4]
mov dword [0x110e51e0], 0
mov byte [0x110e5470], 0
mov dword [0x110e51d8], eax
pop ecx
ret
Function at 0x11055a40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
cmp byte [0x110fca73], 0
push esi
jne 0x11055b93
push 2
push 0x110559b0
mov edx, 0x44c4a7
mov cl, 0xe8
call fcn.1100fb30
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44c760
call esi
mov eax, 0x11055990
sub eax, 0x44c764
mov dword [0x44c760], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44c760
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44c69b
call esi
mov eax, 0x110559e0
sub eax, 0x44c69f
mov dword [0x44c69b], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44c69b
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44b830
call esi
mov eax, 0x11055660
mov byte [0x44b830], 0xe8
sub eax, 0x44b835
mov dword [0x44b831], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44b830
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42b236
call esi
mov eax, 0x11055a20
sub eax, 0x42b23a
mov dword [0x42b236], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x42b236
call esi
sub esp, 0x28
mov ecx, 0x110e516c
mov eax, esp
mov dword [eax], 0x110b8a54
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.110053e0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x11055b8c
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
mov byte [0x110fca73], 1
pop esi
add esp, 0x10
ret

Function at 0x11055ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11055be5
lea ecx, [esp]
push ecx
push str.NPCAutoLevel
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11055be5
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11055bde
mov ecx, dword [ecx]
call fcn.11011f90
jmp 0x11055be7
xor eax, eax
test eax, eax
setne al
mov byte [0x110d720e], al
test al, al
je 0x11055c47
cmp byte [0x110c6683], 0
je 0x11055c18
test byte [0x110c66ec], 1
je 0x11055c18
push 1
mov edx, 1
mov ecx, str.Applying_NPC_autolevel_patch.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 1
push 0x495cfb
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov byte [0x495cfb], 0xeb
push eax
push dword [esp + 4]
push 1
push 0x495cfb
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x11056be0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [ecx], 0
push esi
jne 0x11056c23
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43c77d
mov byte [0x110f6adc], 0
call esi
lea eax, [esp + 4]
mov dword [0x43c77d], 0x488cb
push eax
push dword [esp + 8]
push 4
push 0x43c77d
call esi
pop esi
pop ecx
ret
push 0xffffffffffffffff
push ecx
push 0x21
push 0x110f6adc
call fcn.11089e9c
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
add esp, 0x10
push eax
push 0x40
push 4
push 0x43c77d
call esi
mov eax, 0x11056bb0
sub eax, 0x43c781
mov dword [0x43c77d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43c77d
call esi
pop esi
pop ecx
ret

Function at 0x110580e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 5
push 0x478ac4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x110580a0
mov byte [0x478ac4], 0xe9
sub eax, 0x478ac9
mov dword [0x478ac5], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x478ac4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x110f7594], 0
mov byte [0x110e30f0], 1
pop ecx
ret
Function at 0x11059aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11059ae5
lea ecx, [esp]
push ecx
push str.FastShotFix
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11059ae5
mov ecx, dword [esp]
cmp dword [ecx + 0x14], 0x10
jb 0x11059ade
mov ecx, dword [ecx]
call fcn.11011f90
jmp 0x11059ae7
xor eax, eax
mov dword [0x110e30ec], eax
sub eax, 1
je 0x11059b7e
sub eax, 1
je 0x11059b59
sub eax, 1
je 0x11059b2c
cmp byte [0x110c6683], 0
je 0x11059bdf
test byte [0x110c66ec], 1
je 0x11059bdf
push 1
mov edx, 1
mov ecx, str.Applying_Fast_Shot_trait_fix.
call fcn.11011060
pop ecx
ret
cmp byte [0x110c6683], 0
je 0x11059bdf
test byte [0x110c66ec], 1
je 0x11059bdf
push 1
mov edx, 1
mov ecx, str.Applying_Fast_Shot_trait_patch__Fallout_1_behavior_.
call fcn.11011060
pop ecx
ret
cmp byte [0x110c6683], 0
je 0x11059bdf
test byte [0x110c66ec], 1
je 0x11059bdf
push 1
mov edx, 1
mov ecx, str.Applying_Fast_Shot_trait_patch__Alternative_behavior_.
call fcn.11011060
pop ecx
ret
cmp byte [0x110c6683], 0
je 0x11059ba1
test byte [0x110c66ec], 1
je 0x11059ba1
push 1
mov edx, 1
mov ecx, str.Applying_Fast_Shot_trait_patch__Haenlomals_tweak_.
call fcn.11011060
lea eax, [esp]
push eax
push 0x40
push 5
push 0x478e79
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x11059a60
mov byte [0x478e79], 0xe9
sub eax, 0x478e7e
mov dword [0x478e7a], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x478e79
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x11059d70
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov edx, dword [0x110e54a8]
mov eax, 0x77975b9
sub edx, dword [0x110e54a4]
imul edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
sar edx, 5
push esi
push edi
mov eax, edx
mov edi, ecx
shr eax, 0x1f
add eax, edx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call ebx
xor ebp, ebp
cmp dword [esp + 0x10], ebp
jbe 0x11059de4
xor esi, esi
jmp 0x11059dc0
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x110e54a4]
push 0x448
add eax, esi
push eax
push edi
call ebx
inc ebp
add esi, 0x448
cmp ebp, dword [esp + 0x10]
jb 0x11059dc0
mov ecx, dword [0x110e54b4]
mov eax, 0x77975b9
sub ecx, dword [0x110e54b0]
imul ecx
push 0
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call ebx
xor ebp, ebp
cmp dword [esp + 0x10], ebp
jbe 0x11059e44
xor esi, esi
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x110e54b0]
push 0x448
add eax, esi
push eax
push edi
call ebx
inc ebp
add esi, 0x448
cmp ebp, dword [esp + 0x10]
jb 0x11059e20
mov ecx, dword [0x110e54c0]
mov eax, 0x77975b9
sub ecx, dword [0x110e54bc]
imul ecx
push 0
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call ebx
xor ebp, ebp
cmp dword [esp + 0x10], ebp
jbe 0x11059ea4
xor esi, esi
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x110e54bc]
push 0x448
add eax, esi
push eax
push edi
call ebx
inc ebp
add esi, 0x448
cmp ebp, dword [esp + 0x10]
jb 0x11059e80
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1105a4a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, dword [0x110e54bc]
mov dword [0x110e54c0], eax
lea eax, [esp]
push eax
push 0x40
push 4
push 0x43c77d
mov dword [0x110c0e24], 2
mov dword [0x110d7a58], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp]
mov dword [0x43c77d], 0x488cb
push eax
push dword [esp + 4]
push 4
push 0x43c77d
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x1105bd50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4974e4
call esi
mov eax, 0x1105ba70
mov byte [0x4974e4], 0xe8
sub eax, 0x4974e9
mov dword [0x4974e5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4974e4
call esi
push 1
push 0x1105ba20
mov edx, 0x497173
mov cl, 0xe8
call fcn.1100fb30
push 1
push 0x1105b690
mov edx, 0x4971b2
mov cl, 0xe8
call fcn.1100fb30
push 1
push 0x1105b6c0
mov edx, 0x497183
mov cl, 0xe8
call fcn.1100fb30
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4971d9
call esi
mov eax, 0x1105b6f0
mov byte [0x4971d9], 0xe8
sub eax, 0x4971de
mov dword [0x4971da], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4971d9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x49721a
call esi
mov eax, 0x1105bbe0
sub eax, 0x49721e
mov dword [0x49721a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x49721a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x498186
call esi
mov eax, 0x1105b870
mov byte [0x498186], 0xe9
sub eax, 0x49818b
mov dword [0x498187], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x498186
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4982b1
call esi
mov eax, 0x1105b920
sub eax, 0x4982b5
mov dword [0x4982b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4982b1
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x497a7d
call esi
mov eax, 0x1105b630
mov byte [0x497a7d], 0xe8
sub eax, 0x497a82
mov dword [0x497a7e], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x497a7d
call esi
pop esi
pop ecx
ret
Function at 0x1105e340
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
xor eax, eax
push ebx
push esi
mov bh, dl
mov esi, ecx
push edi
cmp bh, 1
je 0x1105e382
mov edi, dword [0x5193cc]
cmp byte [edi], al
je 0x1105e377
mov cl, byte [edi]
movsx cx, cl
mov word [esp + eax*2 + 0x20], cx
inc eax
mov cl, byte [edi + eax]
test cl, cl
jne 0x1105e366
mov ecx, 0x5c
mov word [esp + eax*2 + 0x20], cx
inc eax
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x1105e3a1
jmp 0x1105e390
movsx cx, cl
mov word [esp + eax*2 + 0x20], cx
inc eax
mov cl, byte [esi + eax]
test cl, cl
jne 0x1105e390
cmp eax, 0x104
jb 0x1105e3b3
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
lea edx, [esp + eax*2 + 0x1c]
mov word [esp + eax*2 + 0x20], cx
lea edi, [esp + eax*2 + 0x1a]
xor bl, bl
mov dword [esp + 0x14], edx
lea eax, [esp + eax*2 + 0x1e]
mov byte [esp + 0x10], bl
mov dword [esp + 0x1c], eax
mov esi, 0x110b1920
lea esp, [esp]
mov ecx, dword [esi]
movzx eax, word [ecx]
mov word [edi], ax
movzx eax, word [ecx + 2]
mov word [edx], ax
movzx eax, word [ecx + 4]
mov ecx, dword [esp + 0x1c]
mov word [ecx], ax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1105e41a
mov edx, dword [esp + 0x14]
add esi, 4
cmp esi, 0x110b192c
jl 0x1105e3e0
jmp 0x1105e420
mov bl, 1
mov byte [esp + 0x10], bl
mov ecx, 0x110b8e84
lea eax, [esp + 0x20]
test bl, bl
cmove eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [0x110e5524]
mov esi, dword [eax]
lea eax, [esp + 0x14]
push eax
push dword [ebp + 8]
push dword [esi + 4]
push esi
call fcn.1105fd90
mov edx, dword [0x110e5528]
mov ecx, 0x4924923
sub ecx, edx
mov edi, eax
cmp ecx, 1
jb 0x1105e4a0
inc edx
mov ecx, 0x110e5520
mov dword [0x110e5528], edx
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [0x110e5524]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1105f980
push dword [esp + 0x10]
lea edx, [esp + 0x24]
mov cl, bh
call fcn.1105e170
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1107d07e
int3
Function at 0x1105f770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
cmp ebx, 0x10
jb 0x1105f789
mov esi, dword [ebp]
jmp 0x1105f78b
mov esi, ebp
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1105f7a7
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1105f796
mov eax, dword [0x110e5538]
mov ecx, dword [0x110e552c]
and eax, edx
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [esp + 0x1c], edx
lea eax, [ecx + eax*4]
mov dword [esp + 0x10], eax
jmp 0x1105f7d0
mov ecx, dword [0x110e5524]
cmp edx, ecx
jne 0x1105f7de
mov eax, ecx
jmp 0x1105f7e2
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1105f878
lea ecx, [esi + 8]
cmp ebx, 0x10
jb 0x1105f7f7
mov edx, dword [ebp]
jmp 0x1105f7f9
mov edx, ebp
cmp dword [ecx + 0x14], 0x10
lea ebx, [ecx + 0x10]
jb 0x1105f804
mov ecx, dword [ecx]
mov ebx, dword [ebx]
mov eax, edi
cmp ebx, edi
cmovb eax, ebx
push eax
call fcn.1100c510
add esp, 4
test eax, eax
jne 0x1105f820
cmp ebx, edi
jb 0x1105f820
jbe 0x1105f82f
mov esi, dword [esi]
mov ebx, dword [ebp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
jmp 0x1105f7d0
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
lea ebx, [edx + 0x10]
jb 0x1105f83d
mov edx, dword [edx]
cmp dword [ebp + 0x14], 0x10
jb 0x1105f846
mov ebp, dword [ebp]
mov ebx, dword [ebx]
mov ecx, ebp
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
call fcn.1100c510
add esp, 4
test eax, eax
jne 0x1105f864
cmp edi, ebx
jb 0x1105f864
jbe 0x1105f86a
mov esi, dword [0x110e5524]
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret 8