joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x504b88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x48b980
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498041
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x48b9bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x48b9bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498041
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x48baa3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x48b9e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48ba17
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004a2ae9
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498041
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x48baa3
cmp eax, 1
jle 0x48ba76
cmp eax, 3
jne 0x48baa3
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004a2ae9
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498041
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x48ba93
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a19cb
add esp, 0x10
cmp edi, eax
jne 0x48baa3
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x48b9a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00498041
mov esp, ebp
pop ebp
ret 4
Function at 0x48c590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x504b88]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x48c631
cmp byte [esi + 0x3d], 0
je 0x48c631
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x48c5e7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x48c5f9
sub eax, 1
je 0x48c5fd
sub eax, 2
je 0x48c631
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498041
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x48c61a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a19cb
add esp, 0x10
cmp edi, eax
jne 0x48c5e7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498041
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00498041
mov esp, ebp
pop ebp
ret

Function at 0x48dad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x48db01
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x48daf0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4b1ed6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b1d4c

Function at 0x5201e6
Capabilities:
Encode data using xor

Disassembly:
call 0x52376a
add byte [eax], al
inc edi
je 0x520244
jns 0x520266
je 0x52025a
insd dword es:[edi], dx
dec ebp
outsb dx, byte gs:[esi]
jne 0x5201fb
add byte [eax], al
inc edi
je 0x520254
je 0x520267
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[edx + 0x68], dl
test al, 0x9e
cli
pop eax
and al, 0x8d
and al, 4
out dx, al
cwde
sbb byte [esi - 0x446f81c6], dh
fisttp qword [edx]
mov fs, ebp
or ebp, eax
or al, al
fcmovbe st(0), st(2)
mul byte [edi + 0x3daf6947]
iretd
scasd eax, dword es:[edi]
cmp eax, 0xfd2b9bcf
jae 0x5201f9
imul ecx, ecx, 0xb87aaeb3
jp 0x520220
mov eax, 0x3496cf25
xor al, 0x14
or edx, dword [edi - 0x31]
fcmove st(0), st(1)
dec edi
jl 0x52026a
and eax, 0x343496cf
xchg esi, eax
xor al, 0x34
adc al, 0xb
push edi
iretd
pop esp
xor byte [edx + 0x6458d8d2], bh
pop edx
insb byte es:[edi], dx
enter 0xffffffffffff90e8, 4
ret 0xf7dc

Function at 0x525e92
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
pushal
mov dword [esp], 0xdc2608c8
mov dword [esp + 0x40], 0x51ccd5
jmp 0x526d7d
pushfd
push edi
lea esp, [esp + 8]
jne 0x524411
push edx
cwde
movsx ax, bl
mov byte [edi - 1], 0
movzx ax, cl
cwde
lea eax, [ebx - 0x47400fb9]
mov dword [esp], ebx
pushfd
lahf
lea eax, [0x529684]
jmp 0x51e3a0
pushfd
push dword [esp]
lea esp, [esp + 0x38]
ja 0x524ed6
cmp ah, ch
rol al, 4
test si, 0x695f
sub ebx, edi
mov al, cl
add ebx, esp
sal al, 4
shr al, cl
mov edi, ebx
test bh, 0xb7
ror al, 7
mov al, 0x2e
cmp cx, 0xe129
stc
bt esi, edx
test cl, 0x87
repne scasb al, byte es:[edi]
jmp 0x52752a
mov byte [esp], 0x19
mov dword [esp + 0x3c], eax
mov byte [esp + 8], dl
mov word [esp], 0xfe80
push dword [esp + 0x3c]
ret 0x40
jmp 0x51ea03

Function at 0x529627
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edi + ecx*2]
lea esp, [esp + 4]
jne 0x520512
movsx edi, bl
and di, bx
adc di, si
mov edi, dword [edx + 0x24]
pushfd
add edi, eax
push 0x8a891e13
pushfd
push dword [esp + 8]
jmp 0x51d70c
Function at 0x403030
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x406fe4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x406fe0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x406ff0], eax
call fcn.00401bd5
cmp dword [0x406dac], ebx
jne 0x40306b
push section..text
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00402dd0
push 0x40600c
push 0x406008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x406fdc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x406fd8]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x406004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x4030fe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4030d2
cmp al, 0x22
jne 0x4030c4
cmp byte [esi], 0x22
jne 0x4030db
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4030e5
cmp al, 0x20
jbe 0x4030d7
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x403109
movzx eax, word [ebp - 0x2c]
jmp 0x40310c
cmp byte [esi], 0x20
jbe 0x4030db
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4030fe
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0xc782555
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x78737deb
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x4c7436
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x369e4437
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40143f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x828
push ebx
push esi
push edi
sub eax, eax
mov word [ebp - reloc.kernel32.dll_QueueUserAPC], ax
push 0x400
xor edi, edi
lea eax, [ebp - 0x828]
push eax
push edi
pop ebx
push edi
pop esi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x828]
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
pop edi
cmp edi, 0xffffffff
je 0x4014e0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
pop ebx
mov ecx, ebx
mov dword [ebp - 0x14], eax
call fcn.00401720
push eax
pop esi
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4014c8
cmp dword [ebp - 0x20], ebx
je 0x4014d9
push esi
pop ecx
call fcn.00401790
xor esi, esi
sub ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call fcn.00401271
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00401213
mov edi, dword [ebp - 0xc]
push reloc.kernel32.dll_SetEvent
mov eax, dword [edi + 0x3c]
add eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
add eax, 0x18
push 0x3000
add eax, ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push eax
pop ebx
mov dword [ebp - 8], ebx
or ebx, ebx
je 0x401650
push reloc.kernel32.dll_SetEvent
push edi
pop edx
push ebx
pop ecx
call fcn.00401730
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebx + 0x3c]
movzx eax, word [esi + 0x14]
add ecx, ebx
push eax
mov edx, esi
mov dword [ebp - 4], ecx
call fcn.00401730
movzx ecx, word [esi + 0x14]
mov edx, dword [ebp - 4]
movzx edi, word [esi + 6]
lea eax, [esi + 0x18]
add ecx, eax
movzx eax, word [edx + 0x14]
lea esi, [edx + 0x18]
add esi, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edi
test edi, edi
je 0x4015b9
push ecx
pop ebx
sub ebx, esi
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
jmp 0x483316
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
mov edx, ebx
mov ecx, ebx
jmp section..htext
push edi
pop ecx
call fcn.00401790
mov ecx, esi
call fcn.00401790
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x44ef60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push 4
pop edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x491740]
sub edx, 1
jne 0x44ef67
ret

Function at 0x451c95
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x451cd4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x451cd4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x451cd4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x451cd4
cmp dword [ecx + 0x74], 0xe
jbe 0x451cd4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x45b7d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x45b7ec
xor eax, eax
jmp 0x45b88f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x45b82b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x45b88d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0045b789
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45b88b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x45b88f
jmp 0x45b822
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x46d4b6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046d32c

Function at 0x4712dd
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047125f

Function at 0x474488
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00474105

Function at 0x47a320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47a34d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47a34d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10023880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1002388f
pop dword [ebp - 0x20]
mov eax, 0x8abcd407
add eax, 0x85456488
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x8e07c
push 0
mov eax, 0x87b19abe
add eax, 0x88643686
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x52c9
mov edi, eax
mov esi, 0x75f126b
add esi, 0x8c24995
add esi, dword [ebp - 0x20]
mov ebx, 0x26778675
sub ebx, 0xc8d92e38
xor dword [ebp - 0x10], 0x3c3571f7
mov edx, dword [esi]
mov dword [ebp - 0x14], 0xcc45e2ba
sub edx, ebx
xor dword [ebp - 0xc], 0x6e932747
mov dword [edi], edx
add dword [ebp - 0x10], 0x231abe3c
add edi, 0xe18a8bfd
sub edi, 0xe18a8bf9
add esi, 4
loop 0x100238e8
add eax, 0xc781a355
add eax, 0x387f9aa2
mov ebx, eax
add eax, 5
mov ecx, 0x34fde1fd
add ecx, 0xdb021e03
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10034690
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10200c9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102044b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x1003477f
push 0x55
push 0x102044b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10034768
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.1010ca00
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x102044b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10034713
inc edx
cmp edx, 0x55
jl 0x100346f0
mov byte [ebp - 8], 0
push 0x41
call fcn.10023880
mov esi, eax
add esp, 4
test esi, esi
je 0x10034767
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10023880
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x1003475e
push 0x10033e30
push 0x17
mov byte [eax + esi], 0
mov dword [0x102044b0], esi
mov byte [0x102044b4], 1
call fcn.10023880
add esp, 8
jmp 0x10034767
push esi
call fcn.10023880
add esp, 4
pop esi
mov eax, dword [0x102044b0]
mov ecx, 0x1016b5e8
test eax, eax
cmovne ecx, eax
mov dword [0x102044b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
ret
Function at 0x100a94f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b43
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], vtable.icu_69::UnicodeMatcher.0
mov esi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_69::UnicodeSet.0
mov dword [edi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push dword [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.10023880
test al, al
je 0x100a96f1
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
shl eax, 2
push eax
push dword [esi + 8]
push dword [edi + 8]
call fcn.1010cb60
mov eax, dword [esi + 0x2c]
add esp, 0xc
test eax, eax
je 0x100a9698
cmp dword [eax + 4], 0
je 0x100a9698
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10023880
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100a95f8
lea ecx, [ebp - 0x10]
push ecx
push 1
push sym.icuuc69.dll_uhash_compareUnicodeString_69
push sym.icuuc69.dll_uprv_deleteUObject_69
mov ecx, eax
call fcn.10023880
mov ebx, eax
jmp 0x100a95fa
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [edi + 0x2c], ebx
test ebx, ebx
jne 0x100a960e
mov dword [ebp - 0x10], 7
jmp 0x100a9648
cmp dword [ebp - 0x10], 0
jle 0x100a962f
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1015d234]
mov ecx, ebx
call esi
mov dword [edi + 0x2c], 0
jmp 0x100a9648
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push 0x100aae10
push dword [esi + 0x2c]
call fcn.10023880
cmp dword [ebp - 0x10], 0
jle 0x100a9698
cmp dword [edi + 0x18], 0
jne 0x100a9692
cmp dword [edi + 0x30], 0
jne 0x100a9692
mov eax, dword [edi + 8]
mov dword [eax], 0x110000
mov eax, dword [edi + 0x24]
mov dword [edi + 0x10], 1
test eax, eax
je 0x100a9682
push eax
call fcn.10023880
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100a968e
call sym.icuuc69.dll_public:_void___thiscall_icu_69::UVector::removeAllElements_void_
mov byte [edi + 0x14], 0
mov byte [edi + 0x14], 1
jmp 0x100a96f1
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x100a96f1
mov eax, dword [edi + 0x24]
mov esi, dword [esi + 0x28]
test eax, eax
je 0x100a96c0
push eax
call fcn.10023880
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [esi*2 + 2]
push eax
call fcn.10023880
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
je 0x100a96f1
push esi
push ebx
push eax
mov dword [edi + 0x28], esi
call fcn.10023880
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov eax, dword [edi + 0x24]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8