joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cddc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187d85
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x101b11c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 2
movups xmmword [ebp - 0x28], xmm0
mov eax, 0x475f
mov dword [ebp - 0x14], 0xf
mov word [ebp - 0x28], ax
mov byte [ebp - 0x26], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push dword [0x103272e0]
lea ecx, [ebp - 0x44]
call fcn.1007fa70
push 0x100cdce0
push str.SetJewelStack
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10090340
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x100cde71
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100cde67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100cdf90
push ecx
push edx
call fcn.10141c6c
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ecx, 0xf
jbe 0x100cdebe
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100cdeb4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100cdf90
push ecx
push edx
call fcn.10141c6c
add esp, 8
push str.Data__KGData__Lua__Configs__CustomJewelStack.lua
mov ecx, 0x103272dc
call fcn.100b6df0
push 0x1019a747
push str.StartLoadJewelStack
push 0x103272dc
call fcn.100b6fe0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x48]
add esp, 0xc
push eax
push 0x40
push 6
push 0x7dc964
call esi
mov eax, 0x7dc964
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push 6
push 0x7dc964
call esi
push 0x100cdb90
push 0x7dc964
push 0xe9
call fcn.100cf940
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push 0x40
push 6
push 0x7dd634
call esi
mov eax, 0x7dd634
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push 6
push 0x7dd634
call esi
push 0x100cdcb0
push 0x7dd634
push 0xe9
call fcn.100cf940
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10141944
mov esp, ebp
pop ebp
ret
call fcn.1014e22a
int3

Function at 0x100cf260
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
movss dword [ebp - 8], xmm1
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 4], 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100cf293
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [esi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100cf288
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cf2c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov al, byte [ebp + 8]
push esi
mov byte [ebp - 0xc], al
mov esi, ecx
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x40
sub edx, esi
push 5
sub edx, 5
push esi
mov dword [ebp - 0xb], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100cf2fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov al, byte [ebp - 8]
mov byte [esi + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100cf2f1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100cf330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
movzx esi, dx
mov edi, ecx
push esi
call fcn.10141db2
push esi
mov ebx, eax
push 0x90
push ebx
call fcn.10144040
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100cf37b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
push edi
call fcn.10143ac0
add esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100cf36e
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cf3b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
movsd qword [ebp - 0x10], xmm1
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 4], 0
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100cf3e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [esi + 4], ecx
push 8
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100cf3d8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cf440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x8128ac8]
sub esp, 0x14
mov dword [0x10333384], ecx
mov eax, dword [0x7bc4f04]
mov dword [0x10333388], eax
push esi
mov esi, dword [0xe6172c]
cmp esi, 0xffffffff
je 0x100cf4d5
mov eax, 0x402bc0
call eax
push esi
mov edx, 0x96a4c0
mov ecx, eax
call edx
cmp dword [0x1025c194], 1
mov esi, eax
mov dword [0x1033338c], esi
jne 0x100cf4c6
movzx ecx, byte [esi + 0x2e]
movzx eax, word [esi + 0x84]
push ecx
movzx ecx, byte [esi + 0x2d]
push ecx
push dword [0xe61e18]
push eax
call fcn.10047660
test eax, eax
je 0x100cf4c6
movups xmm0, xmmword [eax + 0x14]
movups xmmword [esi + 0x38], xmm0
movq xmm0, qword [eax + 0x24]
movq qword [esi + 0x48], xmm0
mov al, byte [eax + 0x2c]
mov byte [esi + 0x50], al
mov ecx, dword [0x10333384]
mov byte [0x10333390], 1
jmp 0x100cf51f
mov esi, dword [0xe61730]
cmp esi, 0xffffffff
je 0x100cf505
mov eax, 0x402bc0
call eax
push esi
mov edx, 0x96a4c0
mov ecx, eax
call edx
mov ecx, dword [0x10333384]
mov dword [0x1033338c], eax
mov byte [0x10333390], 2
jmp 0x100cf51f
cmp dword [0x1033338c], 0
je 0x100cf518
mov dword [0x1033338c], 0
mov byte [0x10333390], 0
mov eax, dword [0x879340c]
mov dword [0x10333398], eax
mov eax, dword [0x8793410]
mov dword [0x103333a0], eax
mov eax, dword [0xe61e18]
push ecx
mov dword [0x10333394], eax
movsx eax, word [ecx + 0xe]
push 0x101a1ff0
push 0x10333378
mov dword [0x10333370], eax
call sym.Main.dll_sprintf
mov eax, dword [0x7bc4f04]
add esp, 0xc
movzx ecx, byte [eax + 0x32]
mov eax, dword [0x8128ac8]
movzx eax, word [eax + ecx*2 + 0x78]
mov ecx, 0x105
cmp ax, cx
je 0x100cf5b3
mov ecx, 0x228
cmp ax, cx
je 0x100cf5b3
mov ecx, 0x22b
cmp ax, cx
je 0x100cf5b3
movsd xmm1, qword [0x101a2898]
mov ecx, 0xd27c88
call fcn.100cf3b0
movsd xmm1, qword [0x101a2870]
mov ecx, 0xd281c0
call fcn.100cf3b0
pop esi
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [0x101a2840]
lea eax, [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
push 0xd27c88
movsd qword [esp + 0x20], xmm0
mov dword [esp + 0x18], 0
call esi
test eax, eax
je 0x100cf614
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0xd27c88], eax
lea eax, [esp + 0xc]
push eax
mov dword [0xd27c8c], ecx
push dword [esp + 0xc]
mov dword [esp + 0x14], 0
push 8
push 0xd27c88
call esi
test eax, eax
jne 0x100cf61a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movsd xmm0, qword [0x101a2820]
lea eax, [esp + 8]
push eax
push 0x40
push 8
push 0xd281c0
movsd qword [esp + 0x20], xmm0
mov dword [esp + 0x18], 0
call esi
test eax, eax
je 0x100cf675
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0xd281c0], eax
lea eax, [esp + 0xc]
push eax
mov dword [0xd281c4], ecx
push dword [esp + 0xc]
mov dword [esp + 0x14], 0
push 8
push 0xd281c0
call esi
test eax, eax
jne 0x100cf67b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cf880
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 4
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov dword [ebx], edi
push eax
push dword [ebp - 4]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cf8c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea eax, [ebp - 4]
movss dword [ebp - 8], xmm1
push eax
push 0x40
mov edi, ecx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movss dword [edi], xmm0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100cf900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100cf940
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp + 8]
cmp al, 0xff
je 0x100cf960
mov byte [esi], al
mov eax, dword [ebp + 0x10]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100cf980
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.10143ac0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cf9c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push 0x40
push ebx
push eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
mov esi, dword [ebp - 8]
push esi
call fcn.10144040
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cfa10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
mov ebx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
push ecx
push 0x40
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebx + 5]
push eax
call fcn.1014da60
push ebx
push dword [ebp - 4]
mov esi, eax
push esi
call fcn.10143ac0
mov edx, dword [ebp - 4]
lea eax, [ebx - 5]
mov ecx, edx
mov byte [esi + ebx], 0xe9
sub ecx, esi
sub ecx, 5
mov dword [esi + ebx + 1], ecx
sub esi, edx
push eax
lea eax, [edx + 5]
mov byte [edx], 0xe9
push 0x90
sub esi, 5
push eax
mov dword [edx + 1], esi
call fcn.10144040
add esp, 0x1c
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cfa90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x10330df0]
test edx, 0xffff0000
jne 0x100cfbd2
push edi
push 0x101a1ff4
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x100cfbd1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0xc
jb 0x100cfbd1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100cfbd1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100cfbc7
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
push edi
push esi
cmp ecx, dword [ebx + 8]
jne 0x100cfb6d
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
mov edx, dword [ebp - 8]
lea ecx, [edx*4 + 0xc]
cmp eax, ecx
jb 0x100cfbd0
xor edi, edi
test edx, edx
je 0x100cfbc7
nop dword [eax]
mov esi, dword [ebx + edi*4 + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
cmp edi, dword [ebx]
jb 0x100cfb30
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
mov edx, dword [ebp - 8]
lea ecx, [edx*8 + 0xc]
cmp eax, ecx
jb 0x100cfbd0
xor eax, eax
mov dword [ebp - 8], eax
test edx, edx
je 0x100cfbc7
nop
mov esi, dword [ebx + eax*8 + 0x10]
mov edi, dword [ebx + eax*8 + 0xc]
lea eax, [ebp - 4]
add esi, dword [ebp + 8]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov dword [edi], esi
push eax
push dword [ebp - 4]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx]
jb 0x100cfb90
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100df193
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100df1ba
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100df1bd
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100df16f
pop esi
leave
ret 8

Function at 0x100e6e03
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x100e6e26
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x100e6e14
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x100f503b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.101669be
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100f507e
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100f507e
sub eax, 1
je 0x100f5079
sub eax, 1
je 0x100f5075
xor eax, eax
leave
ret
push 3
jmp 0x100f5080
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x100fd890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
push edi
mov edi, dword [esp + 0x1c]
sub eax, 0x40
push edi
sar eax, 2
push eax
push ebx
call fcn.100fcfb0
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x100fd947
lea ebp, [ebx + 0x40]
sub esi, 4
cmp esi, ebp
jbe case.0x100fd918.17
mov eax, dword [esi]
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ebx, cl
mov cx, word [edx*2 + 0x10190e50]
and cx, 7
cmp cx, 2
jne 0x100fd8ff
cmp edi, ebx
jb 0x100fd8c2
cmp edx, 0x2a
jne case.0x100fd918.17
shr eax, 0x10
cmp edi, eax
ja 0x100fd8c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp cx, 1
jne 0x100fd8c2
cmp ebx, edi
jne 0x100fd8c2
add edx, 0xfffffff0
cmp edx, 0x27
ja case.0x100fd918.17
movzx ecx, byte [edx + 0x100fda24]
jmp dword [ecx*4 + 0x100fda10]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, esi
shr edi, 0x10
sub eax, ecx
sub eax, 0x40
push edi
sar eax, 2
push eax
push ecx
call fcn.100fcfb0
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x100fd8c2
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, str.local
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
not eax
pop edi
mov ecx, dword [ecx + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x10]
add ecx, 0x10
mov dword [eax], ecx
mov eax, str.global
ret
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, dword [esp + 0x14]
not edx
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x20]
add edx, 0x10
mov dword [ecx], edx
mov ecx, dword [esi - 4]
cmp cl, 0x10
jne 0x100fd9c2
shr ecx, 8
movzx edx, cl
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x100fd9c2
shr eax, 8
xor eax, dword [esi - 4]
test eax, 0xffff0000
jne 0x100fd9c2
pop edi
pop esi
pop ebp
mov eax, str.method
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, str.field
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
mov edx, dword [ecx + 0x38]
test edx, edx
jne 0x100fd9ef
mov eax, dword [esp + 0x20]
mov edx, 0x101a21e4
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
test eax, eax
je 0x100fd9ff
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100fd9f3
sub eax, 1
jne 0x100fd9f3
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
Function at 0x100fff60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
movzx eax, byte [ebp + 0x24]
lea edx, [eax*4 + 0x14]
call fcn.100fb4f0
mov esi, eax
lea ecx, [ebp + 0x40]
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov word [esi + 5], 8
mov byte [esi + 7], 0
movzx ecx, byte [ebp + 0x25]
add ecx, 0x20
mov eax, ecx
shr eax, 3
and al, 0x20
sub cl, al
mov al, byte [ebp + 0x24]
mov byte [ebp + 0x25], cl
mov byte [esp + 0x18], al
movzx ecx, al
test al, al
je 0x10100011
push ebx
lea ebx, [esi + 0x14]
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov edx, 0x18
call fcn.100fb4f0
lea ebx, [ebx + 4]
lea ecx, [eax + 8]
mov word [eax + 5], 0x105
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 0xffffffff
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx + edi*2]
inc edi
mov ecx, edx
shl edx, 0x18
shr ecx, 0xe
xor edx, ebp
and cl, 1
mov dword [eax + 0x14], edx
mov byte [eax + 7], cl
mov dword [ebx - 4], eax
cmp edi, esi
jb 0x100fffc2
mov esi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
pop ebx
mov byte [esi + 7], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x1011a460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov cl, byte [ebp + 0x81]
mov eax, dword [ebp + 0x214]
mov dl, cl
mov bl, byte [ebp + 0x82]
and dl, 0xc
neg dl
mov byte [esp + 0xb], bl
sbb dl, dl
and dl, 4
neg eax
sbb al, al
and cl, 3
and al, 0xe
shl cl, 3
or dl, al
mov al, byte [ebp + 0x1e4]
or dl, cl
and al, 1
or dl, al
cmp bl, dl
je 0x1011a6b7
mov al, dl
mov byte [ebp + 0x82], dl
and al, 3
lea ebx, [ebp + 0xb10]
push esi
push edi
cmp al, 1
jne 0x1011a4fa
movzx ecx, word [0x1019101e]
movzx esi, word [0x10191024]
add ecx, 0x10002fc0
movzx edi, word [0x1019102a]
add esi, 0x10002fc0
movzx eax, word [0x10191032]
add edi, 0x10002fc0
movzx ebp, word [0x10191038]
jmp 0x1011a51a
mov ecx, dword [ebx + 0x39c]
mov esi, dword [ebx + 0x3a8]
mov edi, dword [ebx + 0x3b4]
movzx eax, word [0x10191034]
movzx ebp, word [0x1019103a]
lea eax, [eax + 0x10002fc0]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x14], eax
lea ebp, [ebp + 0x10002fc0]
mov dh, dl
mov dword [ebx + 0x398], ecx
xor dh, byte [esp + 0x13]
mov al, dl
and al, 6
mov dword [ebx + 0x3a4], esi
mov dword [ebx + 0x3b0], edi
test dh, 6
je 0x1011a5b1
mov edi, ebx
test al, al
jne 0x1011a598
lea esi, [ebx + 0x26c]
mov ecx, 0x55
rep movsd dword es:[edi], dword [esi]
test dl, 0x10
je 0x1011a626
mov dword [ebx + 0x114], 0x10005e5a
mov dword [ebx + 0x118], 0x10005e5a
mov dword [ebx + 0x11c], 0x10005e5a
mov dword [ebx + 0x120], 0x10005e5a
jmp 0x1011a626
test dl, 2
mov ecx, 0x10005e3f
mov eax, 0x10005e67
cmovne eax, ecx
mov ecx, 0x55
rep stosd dword es:[edi], eax
jmp 0x1011a626
test al, al
jne 0x1011a626
mov dword [ebx + 0x12c], ecx
mov dword [ebx + 0x138], esi
mov dword [ebx + 0x144], edi
test dl, 0x10
je 0x1011a5f6
mov dword [ebx + 0x114], 0x10005e5a
mov dword [ebx + 0x118], 0x10005e5a
mov dword [ebx + 0x11c], 0x10005e5a
mov dword [ebx + 0x120], 0x10005e5a
jmp 0x1011a626
mov eax, dword [ebx + 0x380]
mov dword [ebx + 0x114], eax
mov eax, dword [ebx + 0x384]
mov dword [ebx + 0x118], eax
mov eax, dword [ebx + 0x388]
mov dword [ebx + 0x11c], eax
mov eax, dword [ebx + 0x38c]
mov dword [ebx + 0x120], eax
test dh, 8
je 0x1011a66d
lea edi, [ebx + 0x154]
test dl, 8
jne 0x1011a65f
mov ecx, 0xaa
nop dword [eax + eax]
movzx eax, word [ecx + 0x10190f88]
lea edi, [edi + 4]
add eax, 0x10002fc0
add ecx, 2
mov dword [edi - 4], eax
cmp ecx, 0x136
jb 0x1011a640
jmp 0x1011a672
mov ecx, 0x46
mov eax, 0x10005ee4
rep stosd dword es:[edi], eax
jmp 0x1011a682
test dl, 8
jne 0x1011a682
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x154], eax
mov dword [ebx + 0x160], ebp
mov ebp, dword [esp + 0x1c]
test dl, 1
je 0x1011a6b5
test byte [esp + 0x13], 1
jne 0x1011a6b5
mov ax, word [ebp + 0x758]
lea edi, [ebp + 0xa90]
add ax, ax
mov ecx, 0x20
dec ax
movzx eax, ax
mov edx, eax
shl edx, 0x10
or eax, edx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret