joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494386
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3d70]
jne 0x494390
repz ret
jmp fcn.00498cdf

Function at 0x497070
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c3d70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00491542
and dword [ebp - 0x14], 0
cmp dword [0x4c6bfc], 0
mov dword [ebp - 0x18], eax
jne 0x497123
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4971cb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a0fe8
push ebx
call edi
test eax, eax
je 0x4971cb
mov esi, dword [fcn.0048d7d0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c6bfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c6c00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c6c04], eax
call edi
push eax
call esi
mov dword [0x4c6c0c], eax
test eax, eax
je 0x497123
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c6c08], eax
mov eax, dword [0x4c6c08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048d7d4]
cmp eax, ecx
je 0x49717c
cmp dword [0x4c6c0c], ecx
je 0x49717c
push eax
call esi
push dword [0x4c6c0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49717c
test ebx, ebx
je 0x49717c
call edi
test eax, eax
je 0x497173
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x497173
test byte [ebp - 8], 1
jne 0x49717c
or dword [ebp + 0x10], 0x200000
jmp 0x4971af
mov eax, dword [0x4c6c00]
cmp eax, dword [ebp - 0x18]
je 0x4971af
push eax
call esi
test eax, eax
je 0x4971af
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4971af
mov eax, dword [0x4c6c04]
cmp eax, dword [ebp - 0x18]
je 0x4971af
push eax
call esi
test eax, eax
je 0x4971af
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c6bfc]
call esi
test eax, eax
je 0x4971cb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4971cd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00494386
leave
ret
Function at 0x10006650
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x1000666b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10006676
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10006681
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000668c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10006697
bts eax, 3
shr ecx, 1
test cl, 1
je 0x100066a2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x100066ad
bts eax, 1
test cl, 2
je 0x100066b6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10006752
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10006743
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10006660
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006780
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012e010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x1012080c
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.100d819d
add esp, 0xc
test eax, eax
je 0x100067d0
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081d3c
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100d8513
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x10006806
call fcn.100d809f
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081d3c
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100d83d8
add esp, 0x10
test eax, eax
je 0x1000685b
push esi
nop dword [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10006822
push dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push 0x400
push 1
push ebx
call fcn.100d83d8
add esp, 0x10
test eax, eax
jne 0x10006820
pop esi
push ebx
call fcn.100d81e4
push dword [ebp - 8]
call fcn.100d809f
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.10081d3c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1012e010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x1031edc0]
push esi
push eax
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call fcn.100cf7d0
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x10009072
mov eax, dword [edi]
test eax, eax
je 0x10009021
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x10009021
test ebx, ebx
je 0x10009021
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x10009021
cmp dword [ebp - 8], esi
je 0x10009072
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10009041
mov eax, dword [edi + 4]
cmp eax, 3
je 0x10009035
cmp eax, 1
jne 0x10009041
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081d3c
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10081d3c
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c040
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov dword [esi], vtable.CAntiHack.0
test eax, eax
je 0x1000c06c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0
test byte [ebp + 8], 1
je 0x1000c07d
push 0x64
push esi
call fcn.100820e9
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1000c210
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x1000c150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x1000c150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x1000c150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x1000c150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x1000c150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x1000c2a3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000c2f0
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x1012e010]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x5045454
push eax
push 0
push 0
push 0x101218a4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [esp + 0x3a]
movzx eax, word [esp + 0x38]
shl ecx, 0x10
or ecx, eax
movzx eax, word [esp + 0x16]
xor ecx, 0xb542d8e1
push ecx
movzx ecx, word [esp + 0x1c]
shl ecx, 0x10
or ecx, eax
mov eax, dword [esp + 0x16]
xor eax, 0x5d78a569
xor ecx, 0xf45bc123
push ecx
push eax
mov eax, dword [esp + 0x10]
xor eax, 0x12b586fe
push eax
lea eax, [esi + 4]
push str._08X__08X__08X__08X
push eax
call fcn.1000c430
mov ecx, dword [esp + 0x54]
add esp, 0x18
pop esi
xor ecx, esp
call fcn.10081d3c
mov esp, ebp
pop ebp
ret
Function at 0x1000d000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e010]
xor eax, ebp
mov dword [ebp - 4], eax
movsd xmm0, qword [0xd255a0]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10125250]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
andps xmm0, xmmword [0x101258a0]
push 8
push 0xd2c848
movsd qword [ebp - 0x10], xmm0
call esi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
mulsd xmm0, qword [0x10125190]
push eax
addsd xmm0, qword [0x101252e0]
movsd qword [0xd2c848], xmm0
push dword [ebp - 8]
push 8
push 0xd2c848
call esi
movsd xmm0, qword [0xd255a0]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10125250]
push eax
push 0x40
push 8
push 0xd2c898
andps xmm0, xmmword [0x101258a0]
movsd qword [ebp - 0x10], xmm0
call esi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
mulsd xmm0, qword [0x10125190]
push eax
addsd xmm0, qword [0x101252e0]
movsd qword [0xd2c898], xmm0
push dword [ebp - 8]
push 8
push 0xd2c898
call esi
movsd xmm0, qword [0xd255a0]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10125250]
push eax
push 0x40
push 4
push 0xd2c894
andps xmm0, xmmword [0x101258a0]
movsd qword [ebp - 0x10], xmm0
call esi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
mulss xmm0, dword [0x10125200]
addss xmm0, dword [0x10125704]
movss dword [0xd2c894], xmm0
push dword [ebp - 8]
push 4
push 0xd2c894
call esi
movsd xmm0, qword [0xd255a0]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10125250]
push eax
push 0x40
push 4
push 0xd2c8a8
andps xmm0, xmmword [0x101258a0]
movsd qword [ebp - 0x10], xmm0
call esi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
mulss xmm0, dword [0x10125200]
addss xmm0, dword [0x10125704]
movss dword [0xd2c8a8], xmm0
push dword [ebp - 8]
push 4
push 0xd2c8a8
call esi
movsd xmm0, qword [0xd255a0]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10125250]
push eax
push 0x40
push 4
push 0xd2570c
andps xmm0, xmmword [0x101258a0]
movsd qword [ebp - 0x10], xmm0
call esi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
mulss xmm0, dword [0x10125200]
addss xmm0, dword [0x101256fc]
movss dword [0xd2570c], xmm0
push dword [ebp - 8]
push 4
push 0xd2570c
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10081d3c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000d200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1012e010]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x58], 0
je 0x1000d3ee
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push 0xd27bfc
call edi
lea eax, [esp + 0x18]
mov dword [0xd27bfc], 0x42180000
push eax
push dword [esp + 0x1c]
push 4
push 0xd27bfc
call edi
movss xmm0, dword [ebx + 0x60]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x34]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x64]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x38]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movsd xmm0, qword [ebx + 0x68]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x3c]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x70]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x40]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x78]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x44]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movss xmm0, dword [ebx + 0x80]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x48]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x84]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x4c]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x88]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x50]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10081d3c
mov esp, ebp
pop ebp
ret
Function at 0x100129c0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x14], ebx
xor esi, esi
mov edi, 0x402bc0
mov ebx, 0x96a4c0
push esi
call edi
mov ecx, eax
call ebx
test eax, eax
je 0x100129f7
mov byte [eax + 0x314], 0
inc esi
cmp esi, 0xa
jl 0x100129e5
mov eax, 0x63cb40
call eax
mov ebx, dword [ebp - 0x14]
movzx eax, byte [ebx + 5]
push eax
mov eax, 0x4d5130
call eax
add esp, 4
cmp dword [0xe609e8], 4
jne 0x10012a29
mov dword [0xe61e18], 0x49
xor edi, edi
cmp byte [ebx + 7], 0
jbe 0x10012b25
lea esi, [ebx + 0x16]
mov ecx, 0x587380
nop dword [eax]
movzx eax, byte [esi - 0xc]
cmp eax, 4
ja case.0x10012a49.1
jmp dword [eax*4 + 0x10012bbc]
movss xmm0, dword [0x1012570c]
movss dword [ebp - 8], xmm0
movss xmm0, dword [0x10125710]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x101254a8]
jmp 0x10012a81
xorps xmm0, xmm0
movss dword [ebp - 8], xmm0
movss dword [ebp - 0x10], xmm0
movzx eax, byte [esi + 3]
push eax
movss dword [ebp - 0xc], xmm0
call ecx
movss xmm0, dword [ebp - 0xc]
movzx ecx, byte [esi - 0xc]
movss dword [esp], xmm0
sub esp, 8
movss xmm0, dword [ebp - 0x10]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push 0
push eax
push ecx
mov eax, 0x586da0
call eax
mov edx, eax
add esp, 0x18
test edx, edx
je 0x10012b10
mov cx, word [esi]
mov word [edx + 0x82], cx
mov cl, byte [esi + 2]
mov byte [edx + 0x15], cl
movups xmm0, xmmword [esi - 0xb]
push 0
push 0
movups xmmword [edx + 0x38], xmm0
movq xmm0, qword [esi + 5]
movq qword [edx + 0x48], xmm0
movzx eax, byte [esi + 0xd]
mov byte [edx + 0x50], al
mov byte [edx + 0x42], 0
movzx eax, byte [esi + 0x15]
mov byte [edx + 0x18], al
lea eax, [esi + 4]
push eax
movzx eax, byte [esi - 0xc]
push eax
call fcn.10061660
add esp, 0x10
movzx eax, byte [ebx + 7]
inc edi
add esi, 0x22
mov ecx, 0x587380
cmp edi, eax
jl 0x10012a40
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x87935a4
call edi
lea eax, [ebp - 8]
mov dword [0x87935a4], 0x33
push eax
push dword [ebp - 8]
push 4
push 0x87935a4
call edi
mov bl, byte [ebx + 8]
mov eax, 0x861110
call eax
mov edx, 0x861a80
mov ecx, eax
call edx
push ebx
mov edx, 0x856bd0
mov ecx, eax
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xe8cb30
call edi
lea eax, [ebp - 8]
mov dword [0xe8cb30], esi
push eax
push dword [ebp - 8]
push 4
push 0xe8cb30
call edi
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx eax, byte [ecx + 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x10130448], eax
call fcn.10081d3c
mov esp, ebp
pop ebp
ret
Function at 0x10012a50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x14], ebx
xor esi, esi
mov edi, 0x402bc0
mov ebx, 0x96a4c0
push esi
call edi
mov ecx, eax
call ebx
test eax, eax
je 0x100129f7
mov byte [eax + 0x314], 0
inc esi
cmp esi, 0xa
jl 0x100129e5
mov eax, 0x63cb40
call eax
mov ebx, dword [ebp - 0x14]
movzx eax, byte [ebx + 5]
push eax
mov eax, 0x4d5130
call eax
add esp, 4
cmp dword [0xe609e8], 4
jne 0x10012a29
mov dword [0xe61e18], 0x49
xor edi, edi
cmp byte [ebx + 7], 0
jbe 0x10012b25
lea esi, [ebx + 0x16]
mov ecx, 0x587380
nop dword [eax]
movzx eax, byte [esi - 0xc]
cmp eax, 4
ja case.0x10012a49.1
jmp dword [eax*4 + 0x10012bbc]
movss xmm0, dword [0x1012570c]
movss dword [ebp - 8], xmm0
movss xmm0, dword [0x10125710]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x101254a8]
jmp 0x10012a81
xorps xmm0, xmm0
movss dword [ebp - 8], xmm0
movss dword [ebp - 0x10], xmm0
movzx eax, byte [esi + 3]
push eax
movss dword [ebp - 0xc], xmm0
call ecx
movss xmm0, dword [ebp - 0xc]
movzx ecx, byte [esi - 0xc]
movss dword [esp], xmm0
sub esp, 8
movss xmm0, dword [ebp - 0x10]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push 0
push eax
push ecx
mov eax, 0x586da0
call eax
mov edx, eax
add esp, 0x18
test edx, edx
je 0x10012b10
mov cx, word [esi]
mov word [edx + 0x82], cx
mov cl, byte [esi + 2]
mov byte [edx + 0x15], cl
movups xmm0, xmmword [esi - 0xb]
push 0
push 0
movups xmmword [edx + 0x38], xmm0
movq xmm0, qword [esi + 5]
movq qword [edx + 0x48], xmm0
movzx eax, byte [esi + 0xd]
mov byte [edx + 0x50], al
mov byte [edx + 0x42], 0
movzx eax, byte [esi + 0x15]
mov byte [edx + 0x18], al
lea eax, [esi + 4]
push eax
movzx eax, byte [esi - 0xc]
push eax
call fcn.10061660
add esp, 0x10
movzx eax, byte [ebx + 7]
inc edi
add esi, 0x22
mov ecx, 0x587380
cmp edi, eax
jl 0x10012a40
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x87935a4
call edi
lea eax, [ebp - 8]
mov dword [0x87935a4], 0x33
push eax
push dword [ebp - 8]
push 4
push 0x87935a4
call edi
mov bl, byte [ebx + 8]
mov eax, 0x861110
call eax
mov edx, 0x861a80
mov ecx, eax
call edx
push ebx
mov edx, 0x856bd0
mov ecx, eax
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xe8cb30
call edi
lea eax, [ebp - 8]
mov dword [0xe8cb30], esi
push eax
push dword [ebp - 8]
push 4
push 0xe8cb30
call edi
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx eax, byte [ecx + 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x10130448], eax
call fcn.10081d3c
mov esp, ebp
pop ebp
ret
Function at 0x100231a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010f685
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1012e010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x101219e0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.100101d0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push dword [0x10131140]
lea ecx, [ebp - 0x48]
call fcn.1000d660
push 0x100230c0
push str.SetJewelStack
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10012e90
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x10023257
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002324d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023376
push edx
push ecx
call fcn.100820e9
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x100232a4
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002329a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10023376
push edx
push ecx
call fcn.100820e9
add esp, 8
push str.Data__Local__General__Lua__Configs__CustomJewelStack.lua
mov ecx, 0x1013113c
call fcn.10040410
push 0x10120a20
push str.StartLoadJewelStack
push 0x1013113c
call fcn.100405d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
push 0x40
push 6
push 0x7dc964
call esi
mov eax, 0x7dc964
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x7dc964
call esi
push 0x10022f70
push 0x7dc964
push 0xe9
call fcn.1007ca60
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x7dd634
call esi
mov eax, 0x7dd634
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x7dd634
call esi
push 0x10023090
push 0x7dd634
push 0xe9
call fcn.1007ca60
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10081d3c
mov esp, ebp
pop ebp
ret
call fcn.100e403e
int3