joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10076002
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1007605b
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10076002
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10076011
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1047bcb4
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10076062
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1005ced8
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10076101
add edi, 4
add eax, 2
dec ecx
jne 0x10076047
call 0x100760ae
loope 0x100760a4
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100760fe
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1007610f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100760c2
cmp eax, ecx
ja 0x100760c2
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1007614c
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10076142
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1005d3b7
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10076011
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1007605b
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10076002
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10076011
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1047bcb4
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10076062
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1005ced8
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10076101
add edi, 4
add eax, 2
dec ecx
jne 0x10076047
call 0x100760ae
loope 0x100760a4
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100760fe
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1007610f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100760c2
cmp eax, ecx
ja 0x100760c2
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1007614c
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10076142
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1005d3b7
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401fd0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402001
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402001
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x402001
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ed0
nop
mov ecx, 0x647a3230
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x13f0619b
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x76e5506f
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x3d762770
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40f805
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
test al, 0x28
test al, 0x30
test al, 0x38
test al, 0x40
test al, 0x48
test al, 0x50
test al, 0x58
test al, 0x60
test al, 0x68
test al, 0x70
test al, 0x78
test al, 0x80
test al, 0x88
test al, 0x90
test al, 0x98
test al, 0xa0
test al, 0xa8
test al, 0xb0
test al, 0xb8
test al, 0xc0
test al, 0xc8
test al, 0xd0
test al, 0xd8
test al, 0xe0
test al, 0xe8
test al, 0xf0
test al, 0xf8
test al, 0
test eax, 0xa910a908
sbb byte [ecx - 0x56d756e0], ch
xor byte [ecx - 0x56bf56c8], ch
dec eax
test eax, 0xa958a950
pushal
test eax, 0xa970a968
js 0x40f7dd
sub byte [ecx - 0x566f5678], 0x98
test eax, 0xa9a8a9a0
mov al, 0xa9
mov eax, 0xc8a9c0a9
test eax, 0xa9d8a9d0
loopne 0x40f7f7
call 0xf8eae8fc
test eax, 0xaa08aa00
adc byte [edx - 0x55df55e8], ch
sub byte [edx - 0x55c755d0], ch
inc eax
stosb byte es:[edi], al
push eax
stosb byte es:[edi], al
pop eax
stosb byte es:[edi], al
pushal
stosb byte es:[edi], al
push 0x78aa70aa
stosb byte es:[edi], al
sub byte [edx - 0x556f5578], 0x98
stosb byte es:[edi], al
mov al, byte [0xb0aaa8aa]
stosb byte es:[edi], al
mov eax, 0xc8aac0aa
stosb byte es:[edi], al
shr byte [edx - 0x551f5528], 1
call 0xf8ebe93b
stosb byte es:[edi], al
add byte [ebx - 0x54ef54f8], ch
sbb byte [ebx - 0x54d754e0], ch
xor byte [ebx - 0x54bf54c8], ch
dec eax
stosd dword es:[edi], eax
push eax
stosd dword es:[edi], eax
pop eax
stosd dword es:[edi], eax
pushal
stosd dword es:[edi], eax
push 0x78ab70ab
stosd dword es:[edi], eax
sub byte [ebx - 0x546f5478], 0x98
stosd dword es:[edi], eax
mov al, byte [0xb0aba8ab]
stosd dword es:[edi], eax
mov eax, 0xc8abc0ab
stosd dword es:[edi], eax
shr byte [ebx - 0x541f5428], 1
call 0xf8ece97c
stosd dword es:[edi], eax
add byte [eax + ecx + 0x18ac10ac], ch
lodsb al, byte [esi]
and byte [eax + ebp + 0x38ac30ac], ch
lodsb al, byte [esi]
inc eax
lodsb al, byte [esi]
dec eax
lodsb al, byte [esi]
push eax
lodsb al, byte [esi]
pop eax
lodsb al, byte [esi]
pushal
lodsb al, byte [esi]
push 0x78ac70ac
lodsb al, byte [esi]
sub byte [eax + ecx*4 - 0x67536f54], 0xac
mov al, byte [0xb0aca8ac]
lodsb al, byte [esi]
mov eax, 0xc8acc0ac
lodsb al, byte [esi]
shr byte [eax + ebx*8 - 0x17531f54], 1
lodsb al, byte [esi]
invalid
Function at 0x10002c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b746e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov dword [ebx], vtable.cocos2d::CCObject.0
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
mov dword [ebx], vtable.cocos2d::CCAction.0
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x34]
mov dword [ebx], vtable.cocos2d::CCFollow.0
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x2c], eax
movzx eax, byte [edi + 0x30]
mov byte [ebx + 0x30], al
movzx eax, byte [edi + 0x31]
mov byte [ebx + 0x31], al
lea eax, [edi + 0x34]
push eax
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCPoint::constructor_class_cocos2d::CCPoint_const__]
lea eax, [edi + 0x3c]
push eax
lea ecx, [ebx + 0x3c]
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCPoint::constructor_class_cocos2d::CCPoint_const__]
mov eax, dword [edi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [ebx + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10003260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b74ce
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov dword [ebx], vtable.cocos2d::CCObject.0
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x28]
mov esi, dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCPoint::constructor_class_cocos2d::CCPoint_const__]
mov dword [ebx], vtable.cocos2d::CCTouch.0
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov al, byte [edi + 0x24]
mov byte [ebx + 0x24], al
lea eax, [edi + 0x28]
push eax
call esi
lea eax, [edi + 0x30]
push eax
lea ecx, [ebx + 0x30]
call esi
lea eax, [edi + 0x38]
push eax
lea ecx, [ebx + 0x38]
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10003690
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b749e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov dword [edi], vtable.cocos2d::CCObject.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov dword [ebp - 4], 0
lea ecx, [edi + 0x3c]
mov dword [edi], vtable.cocos2d::CCTexture2D.0
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
lea eax, [esi + 0x3c]
push eax
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCSize::constructor_class_cocos2d::CCSize_const__]
movzx eax, byte [esi + 0x44]
mov byte [edi + 0x44], al
movzx eax, byte [esi + 0x45]
mov byte [edi + 0x45], al
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10004190
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b74ce
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov dword [edi], vtable.cocos2d::CCObject.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
lea eax, [esi + 0x20]
mov dword [ebp - 4], 0
mov ebx, dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCPoint::constructor_class_cocos2d::CCPoint_const__]
lea ecx, [edi + 0x20]
push eax
mov dword [edi], vtable.cocos2d::CCSpriteFrame.0
call ebx
lea eax, [esi + 0x28]
lea ecx, [edi + 0x28]
mov edi, dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCSize::constructor_class_cocos2d::CCSize_const__]
push eax
call edi
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x30]
mov esi, dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCRect::constructor_class_cocos2d::CCRect_const__]
add ecx, 0x30
push eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov al, byte [ecx + 0x40]
mov byte [edx + 0x40], al
lea eax, [ecx + 0x44]
push eax
lea ecx, [edx + 0x44]
call esi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
lea eax, [esi + 0x54]
push eax
call ebx
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 0x5c]
push eax
lea ecx, [ebx + 0x5c]
call edi
mov eax, dword [esi + 0x64]
lea ecx, [ebx + 0x68]
mov dword [ebx + 0x64], eax
lea eax, [esi + 0x68]
push eax
call fcn.1001a910
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10007df0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, esi
push edi
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10007e00
sub edx, ecx
xor edi, edi
lea ebx, [edx + esi]
cmp esi, ebx
jae 0x10007e2e
movsx eax, byte [esi]
push eax
call fcn.10073c90
imul edi, edi, 0x1000193
inc esi
movzx ecx, al
add esp, 4
xor edi, ecx
cmp esi, ebx
jb 0x10007e12
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x100083a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b760d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
mov dword [esi], vtable.cocos2d::CCObject.0
mov eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [esi], vtable.cocos2d::CCAction.0
mov dword [esi + 0x1c], eax
mov eax, dword [edx + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edx + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edx + 0x28]
mov dword [esi + 0x28], eax
mov dword [esi], vtable.cocos2d::CCFiniteTimeAction.0
mov eax, dword [edx + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [edx + 0x30]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x30]
mov dword [esi], vtable.cocos2d::CCPlace.0
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCPoint::constructor_class_cocos2d::CCPoint_const__]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d1e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b749e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov dword [edi], vtable.cocos2d::CCObject.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov dword [ebp - 4], 0
lea ecx, [edi + 0x28]
mov dword [edi], vtable.cocos2d::CCGridBase.0
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCSize::constructor_class_cocos2d::CCSize_const__]
mov eax, dword [esi + 0x30]
lea ecx, [edi + 0x34]
mov dword [edi + 0x30], eax
lea eax, [esi + 0x34]
push eax
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCPoint::constructor_class_cocos2d::CCPoint_const__]
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
movzx eax, byte [esi + 0x40]
mov byte [edi + 0x40], al
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10017bf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b749e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov dword [edi], vtable.cocos2d::CCObject.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
lea eax, [esi + 0x20]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x20]
mov dword [edi], vtable.cocos2d::CCTMXObjectGroup.0
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCPoint::constructor_class_cocos2d::CCPoint_const__]
mov eax, dword [esi + 0x28]
lea ecx, [edi + 0x30]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
lea eax, [esi + 0x30]
push eax
call fcn.1001a910
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10018320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7b84
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x10129014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov dword [ebx], vtable.cocos2d::CCObject.0
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x28]
mov dword [ebx + 0x20], vtable.cocos2d::CCSAXDelegator.0
mov dword [ebx], vtable.cocos2d::CCTMXMapInfo.0
mov dword [ebx + 0x20], vtable.cocos2d::CCTMXMapInfo.1.0
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
lea eax, [edi + 0x28]
push eax
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCSize::constructor_class_cocos2d::CCSize_const__]
lea eax, [edi + 0x30]
lea ecx, [ebx + 0x30]
push eax
call dword [sym.imp.libcocos2d.dll_public:_void___thiscall_cocos2d::CCSize::constructor_class_cocos2d::CCSize_const__]
mov eax, dword [edi + 0x38]
lea ecx, [ebx + 0x58]
mov dword [ebx + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [ebx + 0x4c], eax
mov al, byte [edi + 0x50]
mov byte [ebx + 0x50], al
mov eax, dword [edi + 0x54]
mov dword [ebx + 0x54], eax
lea eax, [edi + 0x58]
push eax
call fcn.1001a910
lea eax, [edi + 0x74]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x74]
push eax
call fcn.1001a910
lea eax, [edi + 0x90]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebx + 0x90]
call fcn.1001a910
mov eax, dword [edi + 0xac]
mov dword [ebx + 0xac], eax
mov eax, dword [edi + 0xb0]
mov dword [ebx + 0xb0], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10022a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10022aab
sub eax, 1
jne 0x10022adf
push eax
push eax
push dword [ebp + 8]
push 0x10022060
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
cmp dword [0x1012e360], 0
je 0x10022adf
xor edx, edx
xor ecx, ecx
call fcn.10057390
push dword [0x1012e34c]
call fcn.10074030
add esp, 4
mov dword [0x1012e34c], 0
mov dword [0x1012e360], 0
mov eax, 1
pop ebp
ret 0xc