joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ba0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esi, [ebx + 0x13]
push esi
lea edi, [ebx + 8]
push edi
push str.SELECT_account_FROM_TRADE_X_WHERE_account_s_and_name_s
push 0x442698
call fcn.00413700
add esp, 0x10
test al, al
je 0x415c8d
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x415c8d
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
cmp byte [ebx + 0x7aa], 0
jne 0x415c3b
push esi
push edi
push str.DELETE_FROM_TRADE_X_WHERE_account_s_and_name_s
push 0x442698
call fcn.00413700
add esp, 0x10
push dword [0x4426a4]
mov eax, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call eax
mov eax, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x4426a4]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x5d41a0
push 0
lea eax, [ebx + 0x29]
mov dword [0x5d41a0], 0x780
push eax
push 0
push 0x780
push 0xfffffffffffffffd
push 0xfffffffffffffffe
push 1
push 1
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLBindParameter]
movzx eax, byte [ebx + 0x7a9]
push esi
push edi
push eax
lea eax, [ebx + 0x1e]
push eax
push str.UPDATE_TRADE_X_SET_Items__targetname_s__state_d_WHERE_account_s_and_name_s
push 0x442698
call fcn.00413700
add esp, 0x18
jmp 0x415c18
push dword [0x4426a4]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov esi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x4426a4]
call esi
movzx eax, byte [ebx + 0x7a9]
push eax
lea eax, [ebx + 0x13]
push eax
lea eax, [ebx + 8]
push eax
push str.INSERT_INTO_TRADE_X__account_name__state__date__VALUES___s___s___d__getdate___
push 0x442698
call fcn.00413700
add esp, 0x14
push dword [0x4426a4]
call edi
push 2
push dword [0x4426a4]
call esi
lea eax, [ebx + 0x13]
push eax
lea eax, [ebx + 8]
push eax
push 0x780
push 0x780
push str.UPDATE_TRADE_X_SET_ItemsCONVERT_varbinary__d__REPLICATE_char_0xFF___d___WHERE_account_s_AND_name_s
push 0x442698
call fcn.00413700
add esp, 0x18
push dword [0x4426a4]
call edi
push 2
push dword [0x4426a4]
call esi
push 0x5d41a0
push 0
lea eax, [ebx + 0x29]
mov dword [0x5d41a0], 0x780
push eax
push 0
push 0x780
push 0xfffffffffffffffd
push 0xfffffffffffffffe
push 1
push 1
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLBindParameter]
lea eax, [ebx + 0x13]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 0x1e]
push eax
push str.UPDATE_TRADE_X_SET_Items__targetname_s_WHERE_account_s_and_name_s
push 0x442698
call fcn.00413700
add esp, 0x14
push dword [0x4426a4]
call edi
push 2
push dword [0x4426a4]
call esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x415d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x43d008]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00417d10
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
call fcn.00415e10
add esp, 0x10
lea eax, [ebp - 0x104]
push 0x10
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x66c816f9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x11982c99
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10032b90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101fe4b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x10032c7f
push 0x55
push 0x101fe4b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10032c68
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.10108310
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x101fe4b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10032c13
inc edx
cmp edx, 0x55
jl 0x10032bf0
mov byte [ebp - 8], 0
push 0x41
call fcn.1012b8d7
mov esi, eax
add esp, 4
test esi, esi
je 0x10032c67
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.1012b8d7
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x10032c5e
push 0x10032340
push 0x15
mov byte [eax + esi], 0
mov dword [0x101fe4b0], esi
mov byte [0x101fe4b4], 1
call fcn.1012b8d7
add esp, 8
jmp 0x10032c67
push esi
call fcn.1012b8d7
add esp, 4
pop esi
mov eax, dword [0x101fe4b0]
mov ecx, 0x10166518
test eax, eax
cmovne ecx, eax
mov dword [0x101fe4b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
Function at 0x100342a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x358], 0
push edi
push 0x1b0
push eax
mov dword [ebp - 0xc], eax
xor edi, edi
mov word [ebp - 8], ax
mov word [ebp - 0x35c], ax
mov byte [ebp - 0x35a], al
lea eax, [ebp - 0x354]
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.10108310
add esp, 0x24
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.kernel32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
je 0x100343be
push 0x10
call dword [sym.imp.kernel32.dll_GetUserGeoID]
push edi
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.kernel32.dll_GetGeoInfoW]
mov ebx, eax
lea eax, [ebp - 0x358]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x35c]
push 3
push eax
call fcn.1012b8d7
lea eax, [ebp - 0x358]
push eax
push str.windowsZones
push edi
call fcn.1012b8d7
mov esi, eax
lea eax, [ebp - 0x358]
push eax
push esi
push str.mapTimezones
push esi
call fcn.1012b8d7
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2a8]
push eax
push edi
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.1012b8d7
add esp, 0x4c
cmp dword [ebp - 0x358], edi
jle 0x100343d1
test esi, esi
je 0x100343be
push esi
call fcn.1012b8d7
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x2a8], di
je 0x100344b6
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::constructor_void_
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.1012b8d7
add esp, 0x10
cmp dword [ebp - 0x358], edi
jg 0x100344ab
test ebx, ebx
je 0x10034441
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.1012b8d7
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x1003446b
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], edi
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x1a4]
push 0x101684d4
push eax
call fcn.1012b8d7
add esp, 0x10
mov ecx, eax
cmp dword [ebp - 0x358], edi
jg 0x100344ab
movzx eax, word [ecx]
xor edx, edx
test ax, ax
je 0x100344a3
mov ebx, eax
nop
cmp bx, 0x20
je 0x1003449b
add ecx, 2
mov byte [ebp + edx - 0x8c], bl
inc edx
movzx eax, word [ecx]
mov ebx, eax
test ax, ax
jne 0x10034480
cmp edx, 0x80
jae 0x100344f0
mov byte [ebp + edx - 0x8c], 0
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::destructor_void_
cmp byte [ebp - 0x8c], 0
je 0x100344d0
lea eax, [ebp - 0x8c]
push eax
call fcn.1012b8d7
add esp, 4
mov edi, eax
test esi, esi
je 0x100344dd
push esi
call fcn.1012b8d7
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e580b
mov esp, ebp
pop ebp
ret
call fcn.1012b8d7
int3
Function at 0x100a5380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154133
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], vtable.icu_67::UnicodeMatcher.0
mov esi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_67::UnicodeSet.0
mov dword [edi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push dword [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.1012b8d7
test al, al
je 0x100a5581
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
shl eax, 2
push eax
push dword [esi + 8]
push dword [edi + 8]
call fcn.10108470
mov eax, dword [esi + 0x2c]
add esp, 0xc
test eax, eax
je 0x100a5528
cmp dword [eax + 4], 0
je 0x100a5528
push 0x18
mov dword [ebp - 0x10], 0
call fcn.1012b8d7
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100a5488
lea ecx, [ebp - 0x10]
push ecx
push 1
push sym.icuuc67.dll_uhash_compareUnicodeString_67
push sym.icuuc67.dll_uprv_deleteUObject_67
mov ecx, eax
call fcn.1012b8d7
mov ebx, eax
jmp 0x100a548a
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [edi + 0x2c], ebx
test ebx, ebx
jne 0x100a549e
mov dword [ebp - 0x10], 7
jmp 0x100a54d8
cmp dword [ebp - 0x10], 0
jle 0x100a54bf
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1015821c]
mov ecx, ebx
call esi
mov dword [edi + 0x2c], 0
jmp 0x100a54d8
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push 0x100a6cb0
push dword [esi + 0x2c]
call fcn.1012b8d7
cmp dword [ebp - 0x10], 0
jle 0x100a5528
cmp dword [edi + 0x18], 0
jne 0x100a5522
cmp dword [edi + 0x30], 0
jne 0x100a5522
mov eax, dword [edi + 8]
mov dword [eax], 0x110000
mov eax, dword [edi + 0x24]
mov dword [edi + 0x10], 1
test eax, eax
je 0x100a5512
push eax
call fcn.1012b8d7
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100a551e
call sym.icuuc67.dll_public:_void___thiscall_icu_67::UVector::removeAllElements_void_
mov byte [edi + 0x14], 0
mov byte [edi + 0x14], 1
jmp 0x100a5581
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x100a5581
mov eax, dword [edi + 0x24]
mov esi, dword [esi + 0x28]
test eax, eax
je 0x100a5550
push eax
call fcn.1012b8d7
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [esi*2 + 2]
push eax
call fcn.1012b8d7
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
je 0x100a5581
push esi
push ebx
push eax
mov dword [edi + 0x28], esi
call fcn.1012b8d7
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov eax, dword [edi + 0x24]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a55a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154158
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_67::UnicodeSet.0
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1012b8d7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a5650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154188
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.1012b8d7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100a81d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 0xc], ebx
push edi
mov eax, dword [ebx + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
test eax, eax
jle 0x100a8233
mov eax, dword [ebx + 4]
movzx edx, byte [ebp + 8]
mov dword [ebp - 8], eax
nop dword [eax]
mov ebx, dword [eax + esi*8 + 4]
mov ecx, dword [eax + esi*8]
dec ebx
mov eax, ebx
movzx edi, cl
xor eax, ecx
test eax, 0xffffff00
jne 0x100a821c
cmp edi, edx
ja 0x100a8227
jmp 0x100a8220
cmp edi, edx
jbe 0x100a827c
movzx eax, bl
cmp edx, eax
jbe 0x100a827c
mov eax, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jl 0x100a8200
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x100a8271
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100a8271
xor esi, esi
test ecx, ecx
jle 0x100a8271
movzx edi, byte [ebp + 8]
nop dword [eax + eax]
push esi
mov ecx, eax
call fcn.1012b8d7
push 0
mov ecx, eax
call fcn.1012b8d7
movzx eax, al
cmp eax, edi
je 0x100a827c
mov eax, dword [ebx + 0x28]
inc esi
cmp esi, dword [eax + 4]
jl 0x100a8250
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100a96e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154548
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0x18]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 0x10]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1012b8d7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100a97a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154578
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 0xc]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
push dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1012b8d7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100a9f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154688
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_67::UnicodeSet.0
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1012b8d7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1012b8d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1012b8e6
pop dword [ebp - 0xc]
mov eax, 0x735cf6c8
sub eax, 0x634a3de2
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x8d972
push 0
mov eax, 0x8dc64874
add eax, 0x824f38b8
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xbe771655
add ecx, 0x4189392e
mov ebx, eax
mov esi, 0x1ed3aa67
sub esi, 0xeb2b067
add esi, dword [ebp - 0xc]
mov edx, 0x4abc55cd
sub dword [ebp - 8], 0x59821f21
mov edi, dword [esi]
xor dword [ebp - 8], edi
add edi, edx
mov dword [ebx], edi
add dword [ebp - 4], 0x32bc5661
add ebx, 4
add esi, 0xce5690eb
add esi, 0x31a96f19
loop 0x1012b93f
add eax, 0x7288da9a
sub eax, 0x7287a9bb
mov ebx, eax
add eax, 0x118ffffe
sub eax, 0x118ffff9
mov ecx, 0xc1e11572
add ecx, 0x4e1eea8e
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10013a33
pop dword [ebp - 0x10]
mov eax, 0x10013a33
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1a5f50c
sub dword [ebp - 0x20], 0xb353afc1
mov dword [ebp - 0x1c], 0x29a9644b
sub dword [ebp - 0x1c], 0xf7761806
mov dword [ebp - 0x18], 0xdbf69c99
add dword [ebp - 0x18], 0x7055a795
mov dword [ebp - 0x14], 0x83f97684
sub dword [ebp - 0x14], 0x83f97684
lea eax, [ebp - 0x20]
push eax
mov eax, 0x74dd4924
add eax, 0x9b24775c
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x8f2a76dd
sub dword [ebp - 0x20], 0x1ab80d87
mov dword [ebp - 0x1c], 0x7f476157
add dword [ebp - 0x1c], 0xc225001e
mov dword [ebp - 0x18], 0x54814f20
sub dword [ebp - 0x18], 0xf111e2b4
mov dword [ebp - 0x14], 0xeed40f6e
sub dword [ebp - 0x14], 0xeed40f6e
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xeb44c603
add eax, 0x24bcf9fd
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x37e61
push 0
call eax
mov ecx, 0x7df9be0e
sub ecx, 0x7df9741b
xor esi, esi
add esi, eax
mov edx, 0x10026800
add edx, dword [ebp - 0x10]
mov ebx, 0xf637b88d
add dword [ebp - 0xc], ecx
mov edi, dword [edx]
xor dword [ebp - 8], ebx
sub edi, ebx
add dword [ebp - 4], eax
mov dword [esi], edi
xor dword [ebp - 4], edi
add esi, 0xe6067f80
add esi, 0x19f98084
add edx, 0x247bf68f
add edx, 0xdb840975
loop 0x10013b46
add eax, 0xc4d87e11
sub eax, 0xc4d76372
xor ebx, ebx
add ebx, eax
add eax, 0x4fcbc39a
add eax, 0xb0343c6b
mov ecx, 0xc07b2f89
add ecx, 0x4f84d077
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1018869e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10202470]
jne 0x101886a8
repz ret
jmp fcn.101895bc

Function at 0x1018a7bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10187a54
and dword [ebp - 4], 0
cmp dword [0x10203bcc], 0
mov ebx, eax
jne 0x1018a86c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1018a91d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1018a91d
push eax
call fcn.101879e2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10203bcc], eax
call esi
push eax
call fcn.101879e2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10203bd0], eax
call esi
push eax
call fcn.101879e2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10203bd4], eax
call esi
push eax
call fcn.101879e2
pop ecx
mov dword [0x10203bdc], eax
test eax, eax
je 0x1018a86c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.101879e2
pop ecx
mov dword [0x10203bd8], eax
mov eax, dword [0x10203bd8]
cmp eax, ebx
je 0x1018a8c4
cmp dword [0x10203bdc], ebx
je 0x1018a8c4
push eax
call fcn.10187a5d
push dword [0x10203bdc]
mov esi, eax
call fcn.10187a5d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1018a8c4
test edi, edi
je 0x1018a8c4
call esi
test eax, eax
je 0x1018a8bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1018a8bb
test byte [ebp - 0xc], 1
jne 0x1018a8c4
or dword [ebp + 0x10], 0x200000
jmp 0x1018a8fd
mov eax, dword [0x10203bd0]
cmp eax, ebx
je 0x1018a8fd
push eax
call fcn.10187a5d
pop ecx
test eax, eax
je 0x1018a8fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1018a8fd
mov eax, dword [0x10203bd4]
cmp eax, ebx
je 0x1018a8fd
push eax
call fcn.10187a5d
pop ecx
test eax, eax
je 0x1018a8fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10203bcc]
call fcn.10187a5d
pop ecx
test eax, eax
je 0x1018a91d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1018a91f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret