joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90cbe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x90cbee
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x90cbea
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x90cbea
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x90cc60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x90cc84
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x90cc84
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x90cc8c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0090d060
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0090cee0
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0090ceb0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x90cd1e
mov dword [ebp + 0xc], edx
jmp 0x90ccc9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x90cce0
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x90ccf6
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x90cd03
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0090ceb0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x90ccc7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x90cd30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x90cd50
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x90cd50
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x90cd54
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x90cdd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x90cdf0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x90cdf0
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x90cdf4
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x90cdf0
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x90db10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x90dd4c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0090cf30
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x90dcdc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x90dcd2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.008fa750
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x90dcfd
inc eax
cmp byte [esi + eax], 0
jne 0x90dcf6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0090ceb0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x90dd1a
inc edi
cmp byte [edi + ebx], 0
jne 0x90dd13
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x90dd2a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x90dd22
test esi, esi
je 0x90dd3f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0090cf00
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x446eff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x446f0e
pop dword [ebp - 0x38]
mov eax, 0xdd59bcf8
sub eax, 0xdd154dea
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x51299
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4d16
mov edi, eax
mov esi, 0x487e00
add esi, dword [ebp - 0x38]
mov ebx, 0xcd1dbdd8
sub ebx, 0x39d87eeb
xor dword [ebp - 0xc], 0x90a6199
mov edx, dword [esi]
add dword [ebp - 0x28], 0xceff0c93
sub edx, ebx
add dword [ebp - 0x20], 0x1110923f
mov dword [edi], edx
add dword [ebp - 0x2c], edi
add edi, 0x7bfb7685
sub edi, 0x7bfb7681
add esi, 0xe0d43b01
add esi, 0x1f2bc503
loop 0x446f5c
add eax, 0x71381071
add eax, 0x8ec916ba
mov ebx, eax
add eax, 0xd995ca85
add eax, 0x266a3580
mov ecx, 0x82c6943
add ecx, 0xf81396bd
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x491125ad
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x567611fa
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x67181d60
Capabilities:
Query environment variable

Disassembly:
xor eax, eax
lock cmpxchg dword [0x6730d0d0], eax
cmp eax, 2
je 0x67181db0
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6730d0d0
call method.icu_54.umtx_initImplPreInit_icu_54::UInitOnce_
test al, al
jne 0x67181d90
mov eax, dword [0x6730d0cc]
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [0x6730d0cc]
test eax, eax
je 0x67181dc0
mov dword [esp], 0x6730d0d0
call method.icu_54.umtx_initImplPostInit_icu_54::UInitOnce_
mov eax, dword [0x6730d0cc]
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [0x6730d0cc]
ret
mov dword [esp], str.ICU_DATA
call sym._getenv
test eax, eax
mov ebx, eax
mov eax, 0x6728e064
cmove ebx, eax
mov esi, eax
cmp byte [ebx], 0
jne 0x67181e09
mov eax, dword [0x6730d0cc]
test eax, eax
je 0x67181ded
cmp byte [eax], 0
jne 0x67181e4d
mov dword [esp + 4], sym.putil_cleanup__
mov dword [esp], 0x10
mov dword [0x6730d0cc], esi
call sym.icuuc54.dll_ucln_common_registerCleanup_54
jmp 0x67181d99
mov dword [esp], ebx
call sym._strlen
add eax, 2
mov dword [esp], eax
call sym.icuuc54.dll_uprv_malloc_54
test eax, eax
mov esi, eax
je 0x67181d99
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._strcpy
jmp 0x67181e37
mov byte [eax], 0x5c
mov dword [esp + 4], 0x2f
mov dword [esp], esi
call sym._strchr
test eax, eax
jne 0x67181e34
jmp 0x67181ddf
mov dword [esp], eax
call sym.icuuc54.dll_uprv_free_54
jmp 0x67181ded
Function at 0x67181e60
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov edx, dword [ebx]
test edx, edx
jle 0x67181e80
add esp, 0x28
mov eax, 0x6728e064
pop ebx
ret
xor eax, eax
lock cmpxchg dword [sym.icuuc54.dll_gTimeZoneFilesInitOnce_54], eax
cmp eax, 2
je 0x67181f30
mov dword [esp], sym.icuuc54.dll_gTimeZoneFilesInitOnce_54
call method.icu_54.umtx_initImplPreInit_icu_54::UInitOnce_
test al, al
je 0x67181f30
mov dword [esp + 4], sym.putil_cleanup__
mov dword [esp], 0x10
call sym.icuuc54.dll_ucln_common_registerCleanup_54
mov dword [esp], 0x38
call method.icu_54::UMemory.operator_new_unsigned_int_
test eax, eax
je 0x67181f40
lea edx, [eax + 9]
mov dword [eax + 4], 0x28
mov byte [eax + 8], 0
mov dword [eax + 0x34], 0
mov byte [eax + 9], 0
mov dword [eax], edx
mov dword [esp], str.ICU_TIMEZONE_FILES_DIR
mov dword [0x6730d0c8], eax
call sym._getenv
mov edx, 0x6728e064
test eax, eax
cmove eax, edx
mov edx, dword [ebx]
test edx, edx
jle 0x67181f57
mov dword [esp], sym.icuuc54.dll_gTimeZoneFilesInitOnce_54
mov dword [0x6730d044], edx
call method.icu_54.umtx_initImplPostInit_icu_54::UInitOnce_
mov eax, dword [ebx]
test eax, eax
jg 0x67181e6e
mov eax, dword [0x6730d0c8]
mov eax, dword [eax]
add esp, 0x28
pop ebx
ret
mov eax, dword [0x6730d044]
test eax, eax
jle 0x67181f19
mov dword [ebx], eax
jmp 0x67181e6e
mov dword [0x6730d0c8], 0
mov dword [ebx], 7
mov edx, 7
jmp 0x67181f07
mov edx, dword [0x6730d0c8]
lea ecx, [esp + 0x18]
mov dword [edx + 0x34], 0
mov edx, dword [edx]
mov byte [edx], 0
mov dword [esp], eax
call method.icu_54::StringPiece.StringPiece_char_const_
sub esp, 4
mov ecx, dword [0x6730d0c8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call method.icu_54::CharString.append_char_const__int__UErrorCode_
mov eax, dword [0x6730d0c8]
sub esp, 0xc
mov eax, dword [eax]
jmp 0x67181fa5
mov byte [eax], 0x5c
mov dword [esp + 4], 0x2f
mov dword [esp], eax
call sym._strchr
test eax, eax
jne 0x67181fa2
mov edx, dword [ebx]
jmp 0x67181f07
Function at 0x67181fc0
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x34]
mov edx, dword [ebx]
test edx, edx
jle 0x67181fd3
add esp, 0x28
pop ebx
ret
xor eax, eax
lock cmpxchg dword [sym.icuuc54.dll_gTimeZoneFilesInitOnce_54], eax
cmp eax, 2
je 0x671820f0
mov dword [esp], sym.icuuc54.dll_gTimeZoneFilesInitOnce_54
call method.icu_54.umtx_initImplPreInit_icu_54::UInitOnce_
test al, al
je 0x671820f0
mov dword [esp + 4], sym.putil_cleanup__
mov dword [esp], 0x10
call sym.icuuc54.dll_ucln_common_registerCleanup_54
mov dword [esp], 0x38
call method.icu_54::UMemory.operator_new_unsigned_int_
test eax, eax
je 0x67182104
lea edx, [eax + 9]
mov dword [eax + 4], 0x28
mov byte [eax + 8], 0
mov dword [eax + 0x34], 0
mov byte [eax + 9], 0
mov dword [eax], edx
mov dword [esp], str.ICU_TIMEZONE_FILES_DIR
mov dword [0x6730d0c8], eax
call sym._getenv
mov edx, 0x6728e064
test eax, eax
cmove eax, edx
mov edx, dword [ebx]
test edx, edx
jle 0x6718211e
mov dword [esp], sym.icuuc54.dll_gTimeZoneFilesInitOnce_54
mov dword [0x6730d044], edx
call method.icu_54.umtx_initImplPostInit_icu_54::UInitOnce_
mov eax, dword [ebx]
test eax, eax
jg 0x67181fce
mov eax, dword [0x6730d0c8]
lea ecx, [esp + 0x18]
mov dword [eax + 0x34], 0
mov eax, dword [eax]
mov byte [eax], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call method.icu_54::StringPiece.StringPiece_char_const_
sub esp, 4
mov ecx, dword [0x6730d0c8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call method.icu_54::CharString.append_char_const__int__UErrorCode_
mov eax, dword [0x6730d0c8]
sub esp, 0xc
mov eax, dword [eax]
jmp 0x671820d3
mov byte [eax], 0x5c
mov dword [esp + 4], 0x2f
mov dword [esp], eax
call sym._strchr
test eax, eax
jne 0x671820d0
add esp, 0x28
pop ebx
ret
mov eax, dword [0x6730d044]
test eax, eax
jle 0x67182074
mov dword [ebx], eax
add esp, 0x28
pop ebx
ret
mov dword [0x6730d0c8], 0
mov dword [ebx], 7
mov edx, 7
jmp 0x67182062
mov edx, dword [0x6730d0c8]
lea ecx, [esp + 0x18]
mov dword [edx + 0x34], 0
mov edx, dword [edx]
mov byte [edx], 0
mov dword [esp], eax
call method.icu_54::StringPiece.StringPiece_char_const_
sub esp, 4
mov ecx, dword [0x6730d0c8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call method.icu_54::CharString.append_char_const__int__UErrorCode_
mov eax, dword [0x6730d0c8]
sub esp, 0xc
mov eax, dword [eax]
jmp 0x67182173
mov byte [eax], 0x5c
mov dword [esp + 4], 0x2f
mov dword [esp], eax
call sym._strchr
test eax, eax
jne 0x67182170
mov edx, dword [ebx]
jmp 0x67182062
Function at 0x67187370
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov esi, dword [esp + 0x50]
mov dword [esp], esi
call sym.icuuc54.dll_UDataMemory_init_54
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000080
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebx, eax
je 0x671874e0
lea edi, [esp + 0x2c]
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
sub esp, 8
test eax, eax
jne 0x67187480
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov edi, eax
mov dword [esp], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
sub esp, 4
test edi, edi
je 0x671874e0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
test eax, eax
mov dword [esi + 4], eax
je 0x671874d0
mov dword [esi + 0x14], edi
add esp, 0x40
mov eax, 1
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
sub esp, 0x10
test eax, eax
je 0x671873ed
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0xc
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edi
jmp 0x671873ef
mov dword [esp], edi
call ebx
sub esp, 4
nop
lea esi, [esi]
add esp, 0x40
xor eax, eax
pop ebx
pop esi
pop edi
ret
Function at 0x671f8290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test eax, eax
mov ecx, dword [esp + 0x20]
je 0x671f82b4
cmp dword [eax], 0
jle 0x671f82c0
pop ebx
xor eax, eax
pop esi
pop edi
ret
test esi, esi
je 0x671f8300
cmp edi, 0xffffffff
jl 0x671f8300
test edx, edx
je 0x671f8300
cmp ebx, 0xffffffff
jl 0x671f8300
or ecx, 0x10000
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
pop ebx
pop esi
pop edi
jmp sym.icuuc54.dll_u_strcmpFold_54
mov dword [eax], 1
xor eax, eax
pop ebx
pop esi
pop edi
ret
Function at 0x67226300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [eax + 0xe0]
test ecx, ecx
js 0x67226320
mov eax, 1
ret
jmp sym._ubidi_getRuns_54.part.2
Function at 0x6722f9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov ecx, 0x110000
pop ebx
jmp sym.enumEitherTrie_UTrie2_const__int__int__unsigned_int____void_const__unsigned_int___signed_char____void_const__int__int__unsigned_int___void_const_

Function at 0x6722fa20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov ecx, edx
and ecx, 0xfffffc00
cmp ecx, 0xd800
je 0x6722fa50
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
sub edx, 0xd7c0
mov dword [esp + 0x10], ebx
shl edx, 0xa
pop ebx
pop esi
pop edi
lea ecx, [edx + 0x400]
jmp sym.enumEitherTrie_UTrie2_const__int__int__unsigned_int____void_const__unsigned_int___signed_char____void_const__int__int__unsigned_int___void_const_

Function at 0x6723c430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x70]
cmp eax, method.icu_54::UnicodeSet.getRangeCount___const
jne 0x6723c550
mov eax, dword [ecx + 8]
mov edx, eax
shr edx, 0x1f
add edx, eax
sar edx, 1
test edx, edx
jle 0x6723c4f4
movzx ebp, byte [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x18], edx
jmp 0x6723c486
cmp ebx, ebp
jg 0x6723c47d
movzx eax, al
cmp eax, ebp
jge 0x6723c4c0
add esi, 1
cmp esi, dword [esp + 0x18]
je 0x6723c4f4
mov eax, dword [edi]
mov ebx, dword [eax + 0x74]
cmp ebx, method.icu_54::UnicodeSet.getRangeStart_int__const
jne 0x6723c4d0
mov eax, dword [eax + 0x78]
mov ecx, dword [edi + 0x10]
cmp eax, method.icu_54::UnicodeSet.getRangeEnd_int__const
mov ebx, dword [ecx + esi*8]
jne 0x6723c4e8
mov eax, dword [edi + 0x10]
mov eax, dword [eax + esi*8 + 4]
sub eax, 1
mov ecx, eax
xor ecx, ebx
movzx ebx, bl
and ecx, 0xffffff00
je 0x6723c472
cmp ebx, ebp
jg 0x6723c476
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp], esi
mov ecx, edi
call ebx
mov ebx, eax
mov eax, dword [edi]
sub esp, 4
mov eax, dword [eax + 0x78]
cmp eax, method.icu_54::UnicodeSet.getRangeEnd_int__const
je 0x6723c4a3
mov dword [esp], esi
mov ecx, edi
call eax
sub esp, 4
jmp 0x6723c4ad
mov ecx, dword [edi + 0x28]
xor ebx, ebx
movzx esi, byte [esp + 0x1c]
mov eax, dword [ecx + 4]
test eax, eax
jg 0x6723c51b
jmp 0x6723c540
mov ecx, dword [edi + 0x28]
add ebx, 1
cmp dword [ecx + 4], ebx
jle 0x6723c540
mov dword [esp], ebx
call method.icu_54::UVector.elementAt_int__const
sub esp, 4
mov ecx, eax
mov dword [esp], 0
call method.icu_54::UnicodeString.char32At_int__const
movzx eax, al
sub esp, 4
cmp eax, esi
jne 0x6723c510
jmp 0x6723c4c0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4
call eax
mov edx, eax
jmp 0x6723c45d
Function at 0x672477e5
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x67247820
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x67247807
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x67247818
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x67247822
inc edi
add eax, 0x28
cmp edi, esi
jb 0x672477fd
xor eax, eax
pop edi
pop esi
ret

Function at 0x67247ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x26], 0xf9
mov byte [ebp - 0x25], 0xd4
mov byte [ebp - 0x24], 0xf9
mov byte [ebp - 0x23], 0xf9

Function at 0x67247ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x22], 0xfa
mov byte [ebp - 0x21], 0xf6
mov byte [ebp - 0x20], 0x95
invalid
in al, 0xfc
invalid

Function at 0x67247ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ebp - 0x77af1bbb]
pop ebp
in al, 0x88
pop ebp
in eax, 0xc6
inc ebp
out 0xfb, al
invalid

Function at 0x67247af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
out 0xc6, eax
inc ebp
call 0x506a414b
insd dword es:[edi], dx

Function at 0x67247b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6c]
mov byte [ebp - 0x6c], bl
push eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xd2
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x7b
mov byte [ebp - 0x67], 0x44
mov byte [ebp - 0x66], 0x5f
mov byte [ebp - 0x65], 0x59
pop ecx