joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cb640
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x100cb824
push 0xf
call esi
mov ecx, eax
call edi
test al, al
jne 0x100cb824
cmp byte [0x101f9a2d], al
je 0x100cb824
mov ebx, dword [ebp + 8]
mov ecx, 0x101f7630
push 0
push 0x92
push ebx
call fcn.1007ab90
test al, al
je 0x100cb6b0
mov byte [0x101f9a2d], 0
mov byte [0x101f9a35], 0
mov dword [0xe8cb3c], 0
push 0
push 0x93
push ebx
mov ecx, 0x101f7630
call fcn.1007ab90
test al, al
je 0x100cb6ec
mov eax, dword [0x105b0dd0]
test eax, eax
je 0x100cb824
dec eax
mov ecx, 0x105b0dd0
mov dword [0x105b0dd0], eax
call fcn.100cb830
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x94
push ebx
mov ecx, 0x101f7630
call fcn.1007ab90
test al, al
je 0x100cb745
mov ecx, dword [0x105b0dd4]
mov eax, 0x66666667
mov esi, dword [0x105b0dd0]
lea ecx, [ecx - 1]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
je 0x100cb824
lea eax, [esi + 1]
mov ecx, 0x105b0dd0
mov dword [0x105b0dd0], eax
call fcn.100cb830
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, 0x105b0dea
mov esi, 0x101f9c20
nop
movd xmm1, dword [0x10331328]
movss xmm0, dword [esi - 8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100cb812
comiss xmm1, dword [esi]
ja 0x100cb812
movd xmm1, dword [0x10331330]
movss xmm0, dword [esi - 4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100cb812
comiss xmm1, dword [esi + 4]
ja 0x100cb812
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 8]
cmp ebx, 0x201
jne 0x100cb7b2
cmp byte [esi + 0xc], 0
jne 0x100cb812
mov byte [esi + 0xc], 1
jmp 0x100cb812
cmp ebx, 0x202
jne 0x100cb812
cmp eax, 0x1f4
jb 0x100cb812
mov byte [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 8], eax
cmp byte [0x101f9a2d], 0
je 0x100cb824
movzx ecx, word [edi - 2]
mov edx, 0x10
movq xmm0, qword [edi]
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x10], al
mov ax, word [edi + 8]
mov byte [ebp - 0xf], cl
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x20ff10c1
movq qword [ebp - 0xe], xmm0
mov word [ebp - 6], ax
call fcn.100c8890
mov byte [0x101f9a2d], 0
add esi, 0x40
add edi, 0x32
cmp esi, 0x101f9ea0
jl 0x100cb750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100cbb10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10185075
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x101ab040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 2
movups xmmword [ebp - 0x28], xmm0
mov eax, 0x475f
mov dword [ebp - 0x14], 0xf
mov word [ebp - 0x28], ax
mov byte [ebp - 0x26], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push dword [0x10325310]
lea ecx, [ebp - 0x44]
call fcn.1007f050
push 0x100cba30
push str.SetJewelStack
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1008cd70
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x100cbbc1
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100cbbb7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100cbce0
push ecx
push edx
call fcn.100f2fc8
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ecx, 0xf
jbe 0x100cbc0e
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100cbc04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100cbce0
push ecx
push edx
call fcn.100f2fc8
add esp, 8
push str.Data__KGData__Lua__Configs__CustomJewelStack.lua
mov ecx, 0x1032530c
call fcn.100b43d0
push 0x1019768f
push str.StartLoadJewelStack
push 0x1032530c
call fcn.100b4580
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x48]
add esp, 0xc
push eax
push 0x40
push 6
push 0x7dc964
call esi
mov eax, 0x7dc964
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push 6
push 0x7dc964
call esi
push 0x100cb8e0
push 0x7dc964
push 0xe9
call fcn.100cd930
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push 0x40
push 6
push 0x7dd634
call esi
mov eax, 0x7dd634
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push 6
push 0x7dd634
call esi
push 0x100cba00
push 0x7dd634
push 0xe9
call fcn.100cd930
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f2fba
mov esp, ebp
pop ebp
ret
call fcn.1014b33a
int3

Function at 0x100ccfb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
movss dword [ebp - 8], xmm1
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 4], 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100ccfe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [esi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100ccfd8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cd010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov al, byte [ebp + 8]
push esi
mov byte [ebp - 0xc], al
mov esi, ecx
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x40
sub edx, esi
push 5
sub edx, 5
push esi
mov dword [ebp - 0xb], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100cd04c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov al, byte [ebp - 8]
mov byte [esi + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100cd041
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100cd080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
movzx esi, dx
mov edi, ecx
push esi
call fcn.100f342a
push esi
mov ebx, eax
push 0x90
push ebx
call fcn.10141160
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100cd0cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
push edi
call fcn.10140be0
add esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100cd0be
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cd100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
movsd qword [ebp - 0x10], xmm1
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 4], 0
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100cd133
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [esi + 4], ecx
push 8
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100cd128
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cd190
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x101ab040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0xe8c578]
mov esi, ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100cd2a0
push edi
mov edi, dword [0xe8c578]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
jne 0x100cd290
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
mov ecx, esi
call fcn.100cd2e0
push 0x1fc
lea eax, [ebp - 0x200]
push 0
push eax
call fcn.10141160
mov dword [ebp - 0x200], 0x1fc
add esp, 0xc
mov dword [ebp - 0x1f8], 0x444
xor ecx, ecx
mov eax, dword [0xe8c578]
mov dword [ebp - 0x1fc], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x1f4], 0x13
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f0], 0x445
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x60], 0x1388
nop
mov al, byte [ecx + str.Game_has_been_minimized]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x161], al
test al, al
jne 0x100cd250
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x10259e61]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x5d], al
test al, al
jne 0x100cd270
lea eax, [ebp - 0x200]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f2fba
mov esp, ebp
pop ebp
ret
push 5
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
mov ecx, esi
call fcn.100cd2e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100f2fba
mov esp, ebp
pop ebp
ret
Function at 0x100cd430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x8128ac8]
sub esp, 0x14
mov dword [0x10331314], ecx
mov eax, dword [0x7bc4f04]
mov dword [0x10331318], eax
push esi
mov esi, dword [0xe6172c]
cmp esi, 0xffffffff
je 0x100cd4c5
mov eax, 0x402bc0
call eax
push esi
mov edx, 0x96a4c0
mov ecx, eax
call edx
cmp dword [0x1025a1c4], 1
mov esi, eax
mov dword [0x1033131c], esi
jne 0x100cd4b6
movzx ecx, byte [esi + 0x2e]
movzx eax, word [esi + 0x84]
push ecx
movzx ecx, byte [esi + 0x2d]
push ecx
push dword [0xe61e18]
push eax
call fcn.10046e90
test eax, eax
je 0x100cd4b6
movups xmm0, xmmword [eax + 0x14]
movups xmmword [esi + 0x38], xmm0
movq xmm0, qword [eax + 0x24]
movq qword [esi + 0x48], xmm0
mov al, byte [eax + 0x2c]
mov byte [esi + 0x50], al
mov ecx, dword [0x10331314]
mov byte [0x10331320], 1
jmp 0x100cd50f
mov esi, dword [0xe61730]
cmp esi, 0xffffffff
je 0x100cd4f5
mov eax, 0x402bc0
call eax
push esi
mov edx, 0x96a4c0
mov ecx, eax
call edx
mov ecx, dword [0x10331314]
mov dword [0x1033131c], eax
mov byte [0x10331320], 2
jmp 0x100cd50f
cmp dword [0x1033131c], 0
je 0x100cd508
mov dword [0x1033131c], 0
mov byte [0x10331320], 0
mov eax, dword [0x879340c]
mov dword [0x10331328], eax
mov eax, dword [0x8793410]
mov dword [0x10331330], eax
mov eax, dword [0xe61e18]
push ecx
mov dword [0x10331324], eax
movsx eax, word [ecx + 0xe]
push 0x10197d04
push 0x10331308
mov dword [0x10331300], eax
call sym.Main.dll_sprintf
mov eax, dword [0x7bc4f04]
add esp, 0xc
movzx ecx, byte [eax + 0x32]
mov eax, dword [0x8128ac8]
movzx eax, word [eax + ecx*2 + 0x78]
mov ecx, 0x105
cmp ax, cx
je 0x100cd5a3
mov ecx, 0x228
cmp ax, cx
je 0x100cd5a3
mov ecx, 0x22b
cmp ax, cx
je 0x100cd5a3
movsd xmm1, qword [0x1019d3a0]
mov ecx, 0xd27c88
call fcn.100cd100
movsd xmm1, qword [0x1019d378]
mov ecx, 0xd281c0
call fcn.100cd100
pop esi
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [0x1019d348]
lea eax, [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
push 0xd27c88
movsd qword [esp + 0x20], xmm0
mov dword [esp + 0x18], 0
call esi
test eax, eax
je 0x100cd604
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0xd27c88], eax
lea eax, [esp + 0xc]
push eax
mov dword [0xd27c8c], ecx
push dword [esp + 0xc]
mov dword [esp + 0x14], 0
push 8
push 0xd27c88
call esi
test eax, eax
jne 0x100cd60a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movsd xmm0, qword [0x1019d328]
lea eax, [esp + 8]
push eax
push 0x40
push 8
push 0xd281c0
movsd qword [esp + 0x20], xmm0
mov dword [esp + 0x18], 0
call esi
test eax, eax
je 0x100cd665
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0xd281c0], eax
lea eax, [esp + 0xc]
push eax
mov dword [0xd281c4], ecx
push dword [esp + 0xc]
mov dword [esp + 0x14], 0
push 8
push 0xd281c0
call esi
test eax, eax
jne 0x100cd66b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cd870
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 4
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov dword [ebx], edi
push eax
push dword [ebp - 4]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cd8b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea eax, [ebp - 4]
movss dword [ebp - 8], xmm1
push eax
push 0x40
mov edi, ecx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [edi], xmm0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100cd8f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100cd930
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp + 8]
cmp al, 0xff
je 0x100cd950
mov byte [esi], al
mov eax, dword [ebp + 0x10]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100cd970
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.10140be0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cd9b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push 0x40
push ebx
push eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
mov esi, dword [ebp - 8]
push esi
call fcn.10141160
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cda00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
mov ebx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
push ecx
push 0x40
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebx + 5]
push eax
call fcn.1014ab70
push ebx
push dword [ebp - 4]
mov esi, eax
push esi
call fcn.10140be0
mov edx, dword [ebp - 4]
lea eax, [ebx - 5]
mov ecx, edx
mov byte [esi + ebx], 0xe9
sub ecx, esi
sub ecx, 5
mov dword [esi + ebx + 1], ecx
sub esi, edx
push eax
lea eax, [edx + 5]
mov byte [edx], 0xe9
push 0x90
sub esi, 5
push eax
mov dword [edx + 1], esi
call fcn.10141160
add esp, 0x1c
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cda80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x1032ed80]
test edx, 0xffff0000
jne 0x100cdbc2
push edi
push 0x1019d130
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x100cdbc1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0xc
jb 0x100cdbc1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100cdbc1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100cdbb7
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
push edi
push esi
cmp ecx, dword [ebx + 8]
jne 0x100cdb5d
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
mov edx, dword [ebp - 8]
lea ecx, [edx*4 + 0xc]
cmp eax, ecx
jb 0x100cdbc0
xor edi, edi
test edx, edx
je 0x100cdbb7
nop dword [eax]
mov esi, dword [ebx + edi*4 + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
cmp edi, dword [ebx]
jb 0x100cdb20
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
mov edx, dword [ebp - 8]
lea ecx, [edx*8 + 0xc]
cmp eax, ecx
jb 0x100cdbc0
xor eax, eax
mov dword [ebp - 8], eax
test edx, edx
je 0x100cdbb7
nop
mov esi, dword [ebx + eax*8 + 0x10]
mov edi, dword [ebx + eax*8 + 0xc]
lea eax, [ebp - 4]
add esi, dword [ebp + 8]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov dword [edi], esi
push eax
push dword [ebp - 4]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx]
jb 0x100cdb80
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e4528
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x100e454b
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x100e4539
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x100f26ef
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10163bfa
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100f2732
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100f2732
sub eax, 1
je 0x100f272d
sub eax, 1
je 0x100f2729
xor eax, eax
leave
ret
push 3
jmp 0x100f2734
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x100fc1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
push edi
mov edi, dword [esp + 0x1c]
sub eax, 0x40
push edi
sar eax, 2
push eax
push ebx
call fcn.100fb8f0
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x100fc287
lea ebp, [ebx + 0x40]
sub esi, 4
cmp esi, ebp
jbe case.0x100fc258.17
mov eax, dword [esi]
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ebx, cl
mov cx, word [edx*2 + 0x1018dd90]
and cx, 7
cmp cx, 2
jne 0x100fc23f
cmp edi, ebx
jb 0x100fc202
cmp edx, 0x2a
jne case.0x100fc258.17
shr eax, 0x10
cmp edi, eax
ja 0x100fc202
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp cx, 1
jne 0x100fc202
cmp ebx, edi
jne 0x100fc202
add edx, 0xfffffff0
cmp edx, 0x27
ja case.0x100fc258.17
movzx ecx, byte [edx + 0x100fc364]
jmp dword [ecx*4 + 0x100fc350]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, esi
shr edi, 0x10
sub eax, ecx
sub eax, 0x40
push edi
sar eax, 2
push eax
push ecx
call fcn.100fb8f0
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x100fc202
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, str.local
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
not eax
pop edi
mov ecx, dword [ecx + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x10]
add ecx, 0x10
mov dword [eax], ecx
mov eax, str.global
ret
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, dword [esp + 0x14]
not edx
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x20]
add edx, 0x10
mov dword [ecx], edx
mov ecx, dword [esi - 4]
cmp cl, 0x10
jne 0x100fc302
shr ecx, 8
movzx edx, cl
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x100fc302
shr eax, 8
xor eax, dword [esi - 4]
test eax, 0xffff0000
jne 0x100fc302
pop edi
pop esi
pop ebp
mov eax, str.method
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, str.field
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
mov edx, dword [ecx + 0x38]
test edx, edx
jne 0x100fc32f
mov eax, dword [esp + 0x20]
mov edx, 0x1019768f
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
test eax, eax
je 0x100fc33f
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100fc333
sub eax, 1
jne 0x100fc333
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
Function at 0x100fe8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
movzx eax, byte [ebp + 0x24]
lea edx, [eax*4 + 0x14]
call fcn.100f9e30
mov esi, eax
lea ecx, [ebp + 0x40]
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov word [esi + 5], 8
mov byte [esi + 7], 0
movzx ecx, byte [ebp + 0x25]
add ecx, 0x20
mov eax, ecx
shr eax, 3
and al, 0x20
sub cl, al
mov al, byte [ebp + 0x24]
mov byte [ebp + 0x25], cl
mov byte [esp + 0x18], al
movzx ecx, al
test al, al
je 0x100fe951
push ebx
lea ebx, [esi + 0x14]
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov edx, 0x18
call fcn.100f9e30
lea ebx, [ebx + 4]
lea ecx, [eax + 8]
mov word [eax + 5], 0x105
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 0xffffffff
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx + edi*2]
inc edi
mov ecx, edx
shl edx, 0x18
shr ecx, 0xe
xor edx, ebp
and cl, 1
mov dword [eax + 0x14], edx
mov byte [eax + 7], cl
mov dword [ebx - 4], eax
cmp edi, esi
jb 0x100fe902
mov esi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
pop ebx
mov byte [esi + 7], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret