joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101bd997
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [0x101cc9ac], 0x1db4
mov dword [ebp - 4], 0
mov dword [0x101cc9b0], 0x2280
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [0x101cc9ac], 0x11ce
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
add ecx, 0x3c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [0x101cc9b0], 0x392
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
jmp 0x101bda3a
mov dword [0x101cc9ac], 0xaf3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x101bdaa2
jmp 0x101bdafd
mov dword [0x101cc9ac], 0xfffffe28
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x101bdad0
jmp 0x101bdafd
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x101bda71
mov dword [0x101cc9b0], 0xfffff477
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x101bda3a
mov eax, dword [ebp - 0x20]
mov dword [0x101cc9ac], 0x20f2
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x101bdafd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x101bd9f6
jmp 0x101bdafd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101bdafd
mov dword [0x101cc9ac], 0xd8b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x101bda18
jmp 0x101bdafd
mov dword [0x101cc9ac], 0x3a2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x101bdafd
mov dword [0x101cc9b0], 0x231c
mov eax, 1
mov dword [ebp - 0x24], eax
jmp 0x101bdb0c
xor eax, eax
mov dword [0x101cc9ac], 0x1507
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x101be02b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, 0x12ce
mov dword [0x101cc9b8], 0
mov byte [0x101cc9bc], 0
mov dword [0x101cc9ac], 0x12ce
mov dword [0x101cc9b4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x101be0b5
mov eax, dword [0x101cc9b0]
add eax, 0xffffe83d
mov dword [0x101cc9ac], eax
mov dword [0x101cc9b0], 0x1225
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x101cc9b4], 0
mov ecx, dword [0x101cc9ac]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x101be10c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, ecx
mov bl, dl
add eax, 0xfffffe69
mov dword [0x101cc9ac], eax
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], bl
mov dword [0x101cc9b0], 0x541
mov ecx, dword [0x101cc9b4]
add ecx, 1
mov dword [0x101cc9b4], ecx
cmp ecx, 0x100
mov dword [ebp - 0x2c], ecx
jge 0x101be09b
mov eax, dword [0x101cc9ac]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x101be0b5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x101cc9c0], 0
add eax, 0x1868
mov dword [0x101cc9ac], eax
mov eax, dword [0x101cc9b8]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + ecx]
add edi, eax
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 0x34], edx
mov edx, ebx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x101cc9c0], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x34]
idiv edi
mov dword [0x101cc9b8], edx
mov dword [0x101cc9ac], 0x1f2c
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x101cc9bc], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov ecx, dword [0x101cc9ac]
add ecx, 0xffffdc55
mov dword [0x101cc9b0], ecx
mov bl, byte [0x101cc9bc]
mov ecx, dword [0x101cc9b8]
mov byte [esi + ecx], bl
mov ecx, dword [0x101cc9ac]
add ecx, 0xffffe489
mov dword [0x101cc9ac], ecx
mov edx, dword [0x101cc9b4]
add edx, 1
mov dword [0x101cc9b4], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
jl 0x101be10c
jmp 0x101be07a
Function at 0x101be34b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x101cc9b0]
add esi, 0xfffffdc7
mov dword [0x101cc9ac], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101c1322]
mov dh, byte [eax + 0x101c12f3]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x101be375
lea eax, [ebp - 0x24]
mov dword [0x101cc9b0], 0x323
mov dword [0x101cc9ac], 0x263a
mov dword [ebp - 0x34], eax
call fcn.101be4fb
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov ecx, dword [ebp - 0x34]
mov dword [esp + 4], ecx
call fcn.101be5d8
xor ecx, ecx
mov edx, dword [0x101cc9ac]
mov esi, edx
add esi, 0xffffe2e4
mov dword [0x101cc9ac], esi
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
je 0x101be4c0
mov dword [0x101cc9b0], 0xf52
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
add ecx, 0xffffe048
mov dword [0x101cc9ac], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101cc9ac]
add ecx, 0x1edb
mov dword [0x101cc9ac], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.101bdedc
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x101cc9b0], 0x152e
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x50], ecx
mov ecx, dword [ebp - 0x48]
mov dword [edx + 0x54], ecx
mov dword [0x101cc9ac], 0xb3f
cmp ecx, 0
mov dword [ebp - 0x44], eax
je 0x101be4c0
mov eax, dword [ebp - 0x48]
add eax, 0x265f
mov dword [0x101cc9ac], 0xfffffdba
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x101bedf6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101cc9ac], 0x4f2
mov dword [0x101cc9b4], 0
mov dword [0x101cc9b8], 0
mov dword [0x101cc9c4], 0
mov ebx, dword [0x101cc9b0]
add ebx, 0xffffd923
mov dword [0x101cc9b0], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x101befa4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101cc9b4], edx
mov dword [0x101cc9ac], 0x556
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101cc9b8], edx
mov dword [0x101cc9ac], 0x555
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101cc9bc], cl
mov dword [0x101cc9ac], 0x204
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x101cc9b0]
add edx, 0xffffef0b
mov dword [0x101cc9b0], edx
mov cl, byte [0x101cc9bc]
mov edx, dword [0x101cc9b8]
mov byte [edi + edx], cl
mov dword [0x101cc9ac], 0x10cf
mov edx, dword [0x101cc9b4]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101cc9b8]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101cc9c4], ebx
mov dword [0x101cc9ac], 0x3b3f
mov dword [0x101cc9b0], 0x47
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x101cc9c9], ch
mov byte [0x101cc9ca], cl
xor ch, cl
mov byte [0x101cc9c8], ch
mov dword [0x101cc9ac], 0x1843
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
mov dword [0x101cc9b0], 0x2710
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x101befa4
mov eax, dword [0x101cc9b4]
mov ecx, dword [0x101cc9b8]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x101bee6b
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101befac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, esp
mov eax, 0x10
call fcn.101bd680
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x24], eax
call fcn.10001075
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0x20], ecx
jne 0x101bf13a
lea eax, [esi + 0x28]
mov dword [0x101cc9ac], 0x5e
sub esp, 4
mov ecx, dword [esi + 0x24]
mov dword [esp], ecx
mov dword [esi + 0x1c], eax
call fcn.101be76c
add esp, 4
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov dword [esi + 0x60], edx
mov dword [esi + 0x54], 0x138400
mov edx, dword [0x101cc998]
mov dword [esi + 0x28], edx
mov edx, dword [0x101cc99c]
mov dword [esi + 0x58], edx
mov edx, dword [0x101cc9a0]
mov dword [esi + 0x3c], edx
mov edx, dword [0x101cc9a4]
mov dword [esi + 0x80], edx
mov dword [0x101cc9b0], 0xe89
mov dword [esi + 0x18], eax
mov eax, 0xe89
lea ecx, [0x101be2e8]
mov edx, dword [0x101cc9a8]
mov dword [esi + 0x68], edx
mov dword [0x101cc9ac], 0xffffeb71
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp word [eax], 0x5a4d
mov dword [esi + 0xc], eax
mov dword [esi + 8], ecx
jne 0x101bf091
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esi + 4], ecx
je 0x101bf0b5
mov eax, dword [esi + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [esi + 8]
add ecx, 0xfffffabd
mov dword [0x101cc9b0], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], eax
jmp 0x101bf06c
mov eax, dword [esi + 0xc]
mov dword [esi + 0x34], eax
mov dword [0x101cc9ac], 0x82d
mov ecx, dword [esi + 4]
mov edx, dword [eax + ecx + 0x50]
mov dword [esi + 0x64], edx
mov dword [0x101cc9b0], 0x1c20
call fcn.101bd997
xor ecx, ecx
cmp eax, 0
mov dword [esi], ecx
jne 0x101bf135
lea eax, [esi + 0x28]
mov dword [0x101cc9ac], 0xf81
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + 8]
push edx
push eax
call fcn.101be34b
add esp, 8
mov ecx, dword [0x101cc9ac]
add ecx, 0xffffee96
mov dword [0x101cc9b0], ecx
sub esp, 4
mov ecx, esp
lea edx, [esi + 0x28]
mov dword [ecx], edx
call eax
mov eax, 1
mov dword [0x101cc9b0], 0x279
mov dword [esi], eax
mov eax, dword [esi]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x100064d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
test ebx, ebx
jle 0x10006518
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
nop word [eax + eax]
lea esi, [ecx + eax]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
inc ecx
mov al, byte [edx + 0x100fda88]
xor al, byte [edi + esi]
mov byte [esi], al
mov eax, dword [ebp + 8]
cmp ecx, ebx
jl 0x100064f0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10007410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1010800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10108efc]
push esi
mov esi, dword [0x10108f00]
push edi
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10100098]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
andps xmm0, xmmword [0x10100310]
push esi
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
mulsd xmm0, qword [0x10100058]
push eax
push dword [ebp - 8]
push 8
addsd xmm0, qword [0x101000c8]
push esi
movsd qword [esi], xmm0
call edi
mov eax, dword [0x10108efc]
mov esi, dword [0x10108f04]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10100098]
push eax
push 0x40
push 8
push esi
andps xmm0, xmmword [0x10100310]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
mulsd xmm0, qword [0x10100058]
push eax
push dword [ebp - 8]
push 8
addsd xmm0, qword [0x101000c8]
push esi
movsd qword [esi], xmm0
call edi
mov eax, dword [0x10108efc]
mov esi, dword [0x10108f08]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10100098]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10100310]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
push dword [ebp - 8]
mulss xmm0, dword [0x10100080]
push 4
push esi
addss xmm0, dword [0x101001a8]
movss dword [esi], xmm0
call edi
mov eax, dword [0x10108efc]
mov esi, dword [0x10108f0c]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10100098]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10100310]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
push dword [ebp - 8]
mulss xmm0, dword [0x10100080]
push 4
push esi
addss xmm0, dword [0x101001a8]
movss dword [esi], xmm0
call edi
mov eax, dword [0x10108efc]
mov esi, dword [0x10108f10]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10100098]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10100310]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
push dword [ebp - 8]
mulss xmm0, dword [0x10100080]
push 4
push esi
addss xmm0, dword [0x101001a4]
movss dword [esi], xmm0
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100617e6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10007600
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1010800c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x58], 0
je 0x100077f4
movss xmm0, dword [ebx + 0x5c]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x60]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x34]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x64]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x38]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movsd xmm0, qword [ebx + 0x68]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x3c]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x70]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x40]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
movsd qword [esi], xmm0
push eax
push dword [esp + 0x1c]
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x78]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x44]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movss xmm0, dword [ebx + 0x80]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x48]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x84]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x4c]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x88]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x50]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100617e6
mov esp, ebp
pop ebp
ret
Function at 0x10007810
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x1000782b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10007836
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10007841
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000784c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10007857
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10007862
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000786d
bts eax, 1
test cl, 2
je 0x10007876
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10007912
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10007903
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10007820
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007940
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1010800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x100fdb38
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.100c2e9a
add esp, 0xc
test eax, eax
je 0x10007990
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100617e6
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100b7954
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x100079c6
call fcn.100c3036
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100617e6
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100c324c
add esp, 0x10
test eax, eax
je 0x10007a1b
push esi
nop dword [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x100079e2
push dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push 0x400
push 1
push ebx
call fcn.100c324c
add esp, 0x10
test eax, eax
jne 0x100079e0
pop esi
push ebx
call fcn.100c3387
push dword [ebp - 8]
call fcn.100c3036
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.100617e6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10019da0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ee3d5
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1010800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x100fdb50
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.1000c490
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push dword [0x10109ce8]
lea ecx, [ebp - 0x48]
call fcn.10007ab0
push 0x10019cc0
push str.SetJewelStack
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1000d310
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x10019e57
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10019e4d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10019f76
push edx
push ecx
call fcn.10061b0e
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x10019ea4
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10019e9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10019f76
push edx
push ecx
call fcn.10061b0e
add esp, 8
push str.X_Emulator__Custom__CustomJewelStack.lua
mov ecx, 0x10109ce4
call fcn.10034ac0
push 0x100fdfc5
push str.StartLoadJewelStack
push 0x10109ce4
call fcn.10034c20
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
push 0x40
push 6
push 0x7dc964
call esi
mov eax, 0x7dc964
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x7dc964
call esi
push 0x10019b70
push 0x7dc964
push 0xe9
call fcn.1005ef80
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x7dd634
call esi
mov eax, 0x7dd634
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x7dd634
call esi
push 0x10019c90
push 0x7dd634
push 0xe9
call fcn.1005ef80
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100617e6
mov esp, ebp
pop ebp
ret
call fcn.100c35d7
int3