joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11018eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, ecx
push edi
mov edi, edx
xor ebx, ebx
sub ebp, edi
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x10]
cmova ebp, ecx
test ebp, ebp
je 0x11018f04
push esi
mov esi, dword [edi]
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
mov dword [esi], 0x110c0ab4
push eax
push dword [esp + 0x18]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x11018ed1
pop esi
pop edi
pop ebp
pop ebx
ret 4

Function at 0x110190e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fb3
call esi
mov eax, 0x11018f50
sub eax, 0x443fb7
mov dword [0x443fb3], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x443fb3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44401e
call esi
mov eax, 0x11018f90
sub eax, 0x444022
mov dword [0x44401e], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44401e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
mov dword [0x443fef], 0xfffd516d
push eax
push dword [esp + 8]
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x443fec
call esi
mov eax, 0xca89
mov word [0x443fec], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x443fec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x444039
call esi
lea eax, [esp + 4]
mov dword [0x444039], 0x441f0f
push eax
push dword [esp + 8]
push 4
push 0x444039
call esi
pop esi
pop ecx
ret
Function at 0x110196e0
Capabilities:
Copy file
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1109e398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
mov ebx, ecx
mov esi, edx
push 0
mov edx, ebx
lea ecx, [ebp - 0x48]
call fcn.110195b0
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
call fcn.110044e0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x11019742
mov ecx, dword [ebp - 0x48]
inc edx
push 1
call fcn.11004ac0
cmp dword [ebp - 0x20], 0
push edi
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
je 0x1101983e
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
push ebx
call fcn.1108b38f
add esp, 8
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
cmovae eax, dword [ebp - 0x30]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x110b3d88
push ebx
call fcn.11083ee5
mov edi, eax
add esp, 8
test edi, edi
je 0x1101983e
push 0
push 0xd4880
push edi
call fcn.1108ae20
push edi
push 0xa
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x278805c7
push 1
push eax
mov dword [ebp - 0x14], 0xe700006b
mov word [ebp - 0x10], 0x4d
call fcn.1108afe1
push 0
push 0xee5c0
push edi
call fcn.1108ae20
xor eax, eax
push edi
push 0xa
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x70]
push 4
push eax
call fcn.1108afe1
push edi
call fcn.110840c4
add esp, 0x3c
mov ecx, esi
push 9
push str.__restart
call fcn.11008f90
cmp dword [esi + 0x14], 0x10
jb 0x1101982a
mov esi, dword [esi]
push 0xa
push 0
push esi
push ebx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov bl, 1
jmp 0x11019840
xor bl, bl
mov edx, dword [ebp - 0x1c]
pop edi
cmp edx, 0x10
jb 0x11019854
mov ecx, dword [ebp - 0x30]
inc edx
push 1
call fcn.11004ac0
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1101bce0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x110c0ac0]
sub eax, dword [0x5190d0]
cdq
sub eax, edx
sar eax, 1
mov dword [0x5190d8], eax
mov eax, dword [0x110c0abc]
sub eax, dword [0x5190d4]
cdq
sub eax, edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sar eax, 1
mov dword [0x5190dc], eax
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x46ed0f
call esi
mov eax, 0x1101bcb0
sub eax, 0x46ed13
mov dword [0x46ed0f], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x46ed0f
call esi
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x471145
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x471270
push eax
push ecx
mov ecx, 0x1101bcc0
mov dword [esp + 0x18], 0x471301
mov dword [esp + 0x1c], 0x47138b
mov dword [esp + 0x20], 0x474959
mov dword [esp + 0x24], 0x474a23
call fcn.1100fcf0
lea eax, [esp + 4]
push eax
push 0x40
push 6
push 0x46ed23
call esi
mov eax, 0x46ed23
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 6
push 0x46ed23
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 6
push 0x46ed31
call esi
mov eax, 0x46ed31
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 6
push 0x46ed31
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1101bee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x47d52a
call esi
mov eax, 0x1101be70
sub eax, 0x47d52e
mov dword [0x47d52a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x47d52a
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x47ed8d
call esi
mov eax, 0x1101be80
sub eax, 0x47ed91
mov dword [0x47ed8d], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x47ed8d
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x47cc0f
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x47be3d
push eax
push ecx
mov ecx, 0x1101bea0
call fcn.1100fcf0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x47c627
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x47d42f
push eax
push ecx
mov ecx, 0x1101bec0
call fcn.1100fcf0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1101c700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481681
call esi
mov eax, 0x1101c100
sub eax, 0x481685
mov dword [0x481681], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x481681
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481705
call esi
mov eax, 0x1101bfa0
sub eax, 0x481709
mov dword [0x481705], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x481705
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481768
call esi
mov eax, 0x1101c3c0
sub eax, 0x48176c
mov dword [0x481768], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x481768
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481884
call esi
mov eax, 0x1101c5e0
sub eax, 0x481888
mov dword [0x481884], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x481884
call esi
push 1
push 0x1101c450
mov edx, 0x481933
mov cl, 0xe8
call fcn.1100fb30
cmp byte [0x110c676d], 0
je 0x1101c816
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4818a9
call esi
lea eax, [esp + 4]
mov dword [0x4818a9], 0x110e6cec
push eax
push dword [esp + 8]
push 4
push 0x4818a9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x481912
call esi
mov eax, 0xd589
mov word [0x481912], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x481912
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481914
call esi
lea eax, [esp + 4]
mov dword [0x481914], 0x90909090
push eax
push dword [esp + 8]
push 4
push 0x481914
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x48192d
call esi
mov eax, 0x9090
mov word [0x48192d], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x48192d
call esi
sub esp, 0x28
mov esi, 0x1101c610
mov eax, esp
mov dword [eax + 0x24], 0
test esi, esi
je 0x1101c8c1
mov dword [eax], 0x110b3d0c
mov dword [eax + 4], 0x1101c610
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x110e5124
push eax
call fcn.110053e0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1101c90a
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
sub esp, 0x28
mov eax, esp
mov dword [eax + 0x24], 0
test esi, esi
je 0x1101c92a
mov dword [eax], 0x110b3d0c
mov dword [eax + 4], 0x1101c610
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x110e5154
push eax
call fcn.110053e0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1101c973
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
pop esi
add esp, 0x10
ret
Function at 0x1101ca10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0x497405
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x41b979
push eax
push ecx
mov ecx, 0x1101c9e0
mov dword [esp + 0x20], 0x42626b
mov dword [esp + 0x24], 0x43f560
mov dword [esp + 0x28], 0x490005
mov dword [esp + 0x2c], 0x490961
call fcn.1100fcf0
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0x490eac
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x491546
push eax
push ecx
mov ecx, 0x1101c9f0
mov dword [esp + 0x20], 0x497092
mov dword [esp + 0x24], 0x49a1b6
call fcn.1100fcf0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x49a0fb
call edi
lea eax, [esp + 0xc]
mov dword [0x49a0fb], 0x441f0f
push eax
push dword [esp + 0x10]
push 4
push 0x49a0fb
call edi
mov esi, dword [0x110c0abc]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x49042a
call edi
lea eax, [esp + 0xc]
mov dword [0x49042a], esi
push eax
push dword [esp + 0x10]
push 4
push 0x49042a
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x490436
call edi
lea eax, [esp + 0xc]
mov dword [0x490436], esi
push eax
push dword [esp + 0x10]
push 4
push 0x490436
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x49075f
call edi
lea eax, [esp + 0xc]
mov dword [0x49075f], esi
push eax
push dword [esp + 0x10]
push 4
push 0x49075f
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1101d030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x110c6770]
sub esp, 8
test eax, eax
jns 0x1101d048
mov dword [0x110c6770], 0
jmp 0x1101d057
mov ecx, 2
cmp eax, ecx
cmovg eax, ecx
mov dword [0x110c6770], eax
push esi
mov esi, dword [0x110c0abc]
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x44e7d4
call edi
lea eax, [esp + 8]
mov dword [0x44e7d4], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44e7d4
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44e7d9
call edi
lea eax, [esp + 8]
mov dword [0x44e7d9], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44e7d9
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x44e7d2
call edi
lea eax, [esp + 8]
mov byte [0x44e7d2], 0x14
push eax
push dword [esp + 0xc]
push 1
push 0x44e7d2
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
mov dword [0x4877d0], 0x1101ccf0
push eax
push dword [esp + 0xc]
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487813
call edi
lea eax, [esp + 8]
mov dword [0x487813], 0x1101cd70
push eax
push dword [esp + 0xc]
push 4
push 0x487813
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4f5d40
call edi
mov eax, 0x1101cce0
mov byte [0x4f5d40], 0xe8
sub eax, 0x4f5d45
mov dword [0x4f5d41], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4f5d40
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x48738f
call edi
mov eax, fcn.110194e0
sub eax, 0x487393
mov dword [0x48738f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x48738f
call edi
mov esi, dword [0x110c0abc]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487580
call edi
lea eax, [esp + 8]
mov dword [0x487580], esi
push eax
push dword [esp + 0xc]
push 4
push 0x487580
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4875bf
call edi
mov eax, 0x1101cf70
sub eax, 0x4875c3
mov dword [0x4875bf], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4875bf
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
mov byte [0x4875c5], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x44e6b2
call edi
mov eax, 0x1101cf80
mov byte [0x44e6b2], 0xe8
sub eax, 0x44e6b7
mov dword [0x44e6b3], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x44e6b2
call edi
mov dword [esp + 8], 0x44eac9
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x44eadd
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, 0x1101cfa0
call fcn.1100fd70
pop edi
pop esi
add esp, 8
ret
Function at 0x1101d7f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x110c0abc]
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x43fa01
call edi
lea eax, [esp + 8]
mov dword [0x43fa01], esi
push eax
push dword [esp + 0xc]
push 4
push 0x43fa01
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fa14
call edi
lea eax, [esp + 8]
mov dword [0x43fa14], esi
push eax
push dword [esp + 0xc]
push 4
push 0x43fa14
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
mov dword [0x44065a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440024
call edi
mov eax, 0x1101d290
sub eax, 0x440028
mov dword [0x440024], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x440024
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44004f
call edi
mov eax, fcn.1101d2c0
sub eax, 0x440053
mov dword [0x44004f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44004f
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44012a
call edi
mov eax, 0x1101d490
sub eax, 0x44012e
mov dword [0x44012a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44012a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44063a
call edi
mov eax, 0x1101d5f0
sub eax, 0x44063e
mov dword [0x44063a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44063a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fde4
call edi
mov eax, 0x1101d680
sub eax, 0x43fde8
mov dword [0x43fde4], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fde4
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc81
call edi
mov eax, 0x1101d620
sub eax, 0x43fc85
mov dword [0x43fc81], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fc81
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
mov byte [0x43fc75], 0x56
push eax
push dword [esp + 0xc]
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440072
call edi
lea eax, [esp + 8]
mov dword [0x440072], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x440072
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc94
call edi
lea eax, [esp + 8]
mov dword [0x43fc94], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x43fc94
call edi
pop edi
pop esi
pop ecx
ret
Function at 0x1101de80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4444fd
call esi
mov eax, 0x1101de10
sub eax, 0x444501
mov dword [0x4444fd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4444fd
call esi
push 1
push 0x1101da30
mov edx, 0x44451e
mov cl, 0xe8
call fcn.1100fb30
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x442b0c
call esi
mov eax, 0x1101de70
sub eax, 0x442b10
mov dword [0x442b0c], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x442b0c
call esi
pop esi
pop ecx
ret

Function at 0x1101dfe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4c23a8
call esi
mov eax, 0x1101df70
sub eax, 0x4c23ac
mov dword [0x4c23a8], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4c23a8
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4c2e87
call esi
mov eax, 0x1101df80
sub eax, 0x4c2e8b
mov dword [0x4c2e87], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4c2e87
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4bfe75
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x4c3305
push eax
push ecx
mov ecx, 0x1101dfa0
call fcn.1100fcf0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4c0167
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x4c02cd
push eax
push ecx
mov ecx, 0x1101dfc0
call fcn.1100fcf0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4c3312
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x4c332d
mov cl, 0x7f
call fcn.1101e0e0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4c3321
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x4c333b
mov cl, 0x7c
call fcn.1101e0e0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1101e0e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, edx
mov byte [esp + 0xf], cl
sub ebp, edi
xor ecx, ecx
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x14]
cmova ebp, ecx
test ebp, ebp
je 0x1101e139
push esi
mov esi, dword [edi]
lea eax, [esp + 0x18]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0x13]
mov byte [esi], al
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x1101e106
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x1101f110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push esi
push edi
push eax
push 0x40
push 4
push 0x4b15f7
call ebx
mov esi, 0x1101eec0
lea eax, [esi - 0x4b15fb]
mov dword [0x4b15f7], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 4
push 0x4b15f7
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x4b1566
call ebx
lea eax, [esp + 0xc]
sub esi, 0x4b156a
push eax
push dword [esp + 0x10]
mov dword [0x4b1566], esi
push 4
push 0x4b1566
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x483ef1
call ebx
mov esi, 0x1101ef40
lea eax, [esi - 0x483ef5]
mov dword [0x483ef1], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 4
push 0x483ef1
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x483f54
call ebx
lea eax, [esp + 0xc]
sub esi, 0x483f58
push eax
push dword [esp + 0x10]
mov dword [0x483f54], esi
push 4
push 0x483f54
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push 0x44e481
call ebx
mov eax, 0x1101efb0
mov byte [0x44e481], 0xe8
sub eax, 0x44e486
mov dword [0x44e482], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push 0x44e481
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x489803
call ebx
mov eax, 0x1101f040
sub eax, 0x489807
mov dword [0x489803], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 4
push 0x489803
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push 0x44c597
call ebx
mov edi, 0x1101f050
mov byte [0x44c597], 0xe8
lea eax, [edi - 0x44c59c]
mov dword [0x44c598], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push 0x44c597
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push 0x44c5ac
call ebx
mov esi, 0x1101f0e0
mov byte [0x44c5ac], 0xe8
lea eax, [esi - 0x44c5b1]
mov dword [0x44c5ad], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push 0x44c5ac
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push 0x44ba40
call ebx
lea eax, [esp + 0xc]
mov byte [0x44ba40], 0xe8
push eax
sub edi, 0x44ba45
mov dword [0x44ba41], edi
push dword [esp + 0x10]
push 5
push 0x44ba40
call ebx
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push 0x44ba55
call ebx
lea eax, [esp + 0xc]
mov byte [0x44ba55], 0xe8
push eax
sub esi, 0x44ba5a
mov dword [0x44ba56], esi
push dword [esp + 0x10]
push 5
push 0x44ba55
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1101fd30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x48a955
call esi
mov eax, 0x1101fcf0
sub eax, 0x48a959
mov dword [0x48a955], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x48a955
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x483727
call esi
mov eax, 0x1101fd10
sub eax, 0x48372b
mov dword [0x483727], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x483727
call esi
pop esi
pop ecx
ret

Function at 0x11020960
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov edx, dword [0x110e4580]
mov eax, 0x2aaaaaab
sub edx, dword [0x110e457c]
imul edx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, ecx
sar edx, 2
push esi
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
je 0x110209d0
xor esi, esi
lea ecx, [ecx]
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x110e457c]
push 0x14
add eax, esi
push eax
push ebx
call ebp
mov eax, dword [esp + 0x10]
inc edi
add esi, 0x18
cmp edi, eax
jb 0x110209b0
push eax
push str.LOADSAVE:_Total_critter_base_stats_saved:__d_n
call fcn.11014530
mov ecx, dword [0x110e4574]
mov eax, 0x2aaaaaab
sub ecx, dword [0x110e4570]
add esp, 8
imul ecx
push 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
je 0x11020a40
xor esi, esi
lea esp, [esp]
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x110e4570]
push 0x14
add eax, esi
push eax
push ebx
call ebp
mov eax, dword [esp + 0x10]
inc edi
add esi, 0x18
cmp edi, eax
jb 0x11020a20
push eax
push str.LOADSAVE:_Total_critter_bonus_stats_saved:__d_n
call fcn.11014530
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret