joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51edb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa268
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], vtable.icu_64::UnicodeMatcher.0
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_64::UnicodeSet.0
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 4], vtable.icu_64::UnicodeSet.1.0
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
cmp dword [eax], 0
mov dword [ebp - 4], 0
jg 0x51ef25
cmp dword [ebp + 0x10], 0
jne 0x51ef1f
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x51ef1f
cmp dword [ebp + 0xc], 1
jl 0x51ef1f
movzx eax, word [ecx]
xor ebx, ebx
test ax, ax
sets bl
inc ebx
mov dword [ebp + 0x10], ebx
test ax, ax
js 0x51ee82
mov ecx, eax
jmp 0x51ee86
movzx ecx, word [ecx + 2]
and eax, 0x7fff
movzx esi, cx
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
mov dword [ebp + 0x14], eax
lea ecx, [eax + 1]
push ecx
mov ecx, edi
call fcn.005207c0
test al, al
je 0x51ef2c
xor edx, edx
test esi, esi
je 0x51eed5
mov eax, dword [ebp + 8]
lea ebx, [eax + ebx*2]
nop dword [eax]
mov eax, dword [edi + 8]
lea ebx, [ebx + 2]
movzx ecx, word [ebx - 2]
mov dword [eax + edx*4], ecx
inc edx
cmp edx, esi
jl 0x51eec0
mov ebx, dword [ebp + 0x10]
cmp esi, dword [ebp + 0x14]
jge 0x51eefe
mov ecx, dword [ebp + 8]
lea eax, [esi + ebx]
lea edx, [ecx + eax*2]
movzx eax, word [edx]
lea edx, [edx + 4]
movzx ecx, word [edx - 2]
shl eax, 0x10
add ecx, eax
mov eax, dword [edi + 8]
mov dword [eax + esi*4], ecx
inc esi
cmp esi, dword [ebp + 0x14]
jl 0x51eee3
test esi, esi
je 0x51ef0f
mov eax, dword [edi + 8]
cmp dword [eax + esi*4 - 4], 0x110000
je 0x51ef1a
mov eax, dword [edi + 8]
mov dword [eax + esi*4], 0x110000
inc esi
mov dword [edi + 0x10], esi
jmp 0x51ef2c
mov dword [eax], 1
mov ecx, edi
call fcn.00521590
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x520f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov dword [ebp - 4], eax
test eax, eax
jle 0x520f5e
mov eax, dword [edi + 4]
movzx esi, byte [ebp + 8]
mov ecx, dword [eax + edx*8 + 4]
mov ebx, dword [eax + edx*8]
dec ecx
mov eax, ecx
xor eax, ebx
test eax, 0xffffff00
movzx eax, bl
jne 0x520f4d
cmp eax, esi
ja 0x520f58
jmp 0x520f51
cmp eax, esi
jbe 0x520fa2
movzx eax, cl
cmp esi, eax
jbe 0x520fa2
inc edx
cmp edx, dword [ebp - 4]
jl 0x520f2a
mov eax, dword [edi + 0x28]
test eax, eax
je 0x520f97
cmp dword [eax + 4], 0
je 0x520f97
xor esi, esi
cmp dword [eax + 4], esi
jle 0x520f97
movzx ebx, byte [ebp + 8]
push esi
mov ecx, eax
call fcn.005641f0
push 0
mov ecx, eax
call fcn.004df7b0
movzx eax, al
cmp eax, ebx
je 0x520fa2
mov eax, dword [edi + 0x28]
inc esi
cmp esi, dword [eax + 4]
jl 0x520f76
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x532280
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6b66bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
push edi
mov edi, dword [ebp + 8]
push 4
push edi
push 0x20000019
push ebx
call esi
push 4
lea eax, [edi + 4]
push eax
push 0x20000012
push ebx
call esi
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x18
push ebx
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.00532350
push 0xc
mov dword [edi + 8], eax
call fcn.00505f20
add esp, 8
mov dword [edi + 0xc], eax
push 6
push eax
push 0x16
push ebx
call esi
push 0xc
call fcn.00505f20
add esp, 4
mov dword [edi + 0x10], eax
push 6
push eax
push 0x17
push ebx
call esi
push 4
lea eax, [edi + 0x14]
push eax
push 0x2000001c
push ebx
call esi
push 4
lea eax, [edi + 0x18]
push eax
push 0x2000001b
push ebx
call esi
push 0x10
call fcn.00505f20
add esp, 4
mov dword [edi + 0x1c], eax
push 8
push eax
push 0x14
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005f4480
mov esp, ebp
pop ebp
ret
Function at 0x5323a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6b66bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
push edi
mov edi, dword [ebp + 8]
push 4
push edi
push 0x20000011
push ebx
call esi
push 4
lea eax, [edi + 4]
push eax
push 0x20000012
push ebx
call esi
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x10
push ebx
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.00532350
push 0xc
mov dword [edi + 8], eax
call fcn.00505f20
add esp, 8
mov dword [edi + 0xc], eax
push 6
push eax
push 0xe
push ebx
call esi
push 0xc
call fcn.00505f20
add esp, 4
mov dword [edi + 0x10], eax
push 6
push eax
push 0xf
push ebx
call esi
push 4
lea eax, [edi + 0x14]
push eax
push 0x20001010
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005f4480
mov esp, ebp
pop ebp
ret

Function at 0x5370c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb73b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0xc]
movq xmm0, qword [esi]
movq qword [edi], xmm0
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
lea eax, [esi + 0xc]
push eax
call fcn.00536240
lea eax, [esi + 0x1c]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x1c]
call fcn.00536240
movups xmm0, xmmword [esi + 0x30]
movups xmmword [edi + 0x30], xmm0
movups xmm0, xmmword [esi + 0x40]
movups xmmword [edi + 0x40], xmm0
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
movq xmm0, qword [esi + 0x54]
movq qword [edi + 0x54], xmm0
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
movq xmm0, qword [esi + 0x60]
movq qword [edi + 0x60], xmm0
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
movq xmm0, qword [esi + 0x6c]
movq qword [edi + 0x6c], xmm0
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
sub eax, 1
je 0x537170
sub eax, 1
jne 0x53717d
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov dword [esi + 0x7c], 0
mov eax, dword [esi + 0x80]
lea ecx, [edi + 0x8c]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
lea eax, [esi + 0x8c]
push eax
call fcn.00536a60
mov eax, dword [esi + 0x98]
lea ecx, [edi + 0xa8]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
lea eax, [esi + 0xa8]
push eax
call fcn.004dcb00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x537210
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb78f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0xc]
movq xmm0, qword [esi]
movq qword [edi], xmm0
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
lea eax, [esi + 0xc]
push eax
call fcn.00536240
lea eax, [esi + 0x1c]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x1c]
call fcn.00536240
movups xmm0, xmmword [esi + 0x30]
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 1
movups xmmword [edi + 0x30], xmm0
movups xmm0, xmmword [esi + 0x40]
movups xmmword [edi + 0x40], xmm0
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
movq xmm0, qword [esi + 0x54]
movq qword [edi + 0x54], xmm0
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
movq xmm0, qword [esi + 0x60]
movq qword [edi + 0x60], xmm0
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
movq xmm0, qword [esi + 0x6c]
movq qword [edi + 0x6c], xmm0
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
lea eax, [esi + 0x78]
push eax
call fcn.00537a80
mov eax, dword [esi + 0x80]
lea ecx, [edi + 0x8c]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
lea eax, [esi + 0x8c]
push eax
mov byte [ebp - 4], 2
call fcn.00536a90
mov eax, dword [esi + 0x98]
lea ecx, [edi + 0xa8]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
lea eax, [esi + 0xa8]
push eax
mov byte [ebp - 4], 3
call fcn.004dcb30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x538a60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb968
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x6b66bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x5c], ebx
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x54], eax
movzx eax, byte [ebx + 0x18]
push eax
push dword [ebx + 0x30]
movzx eax, byte [ebx + 0x2c]
push dword [ebx + 0x14]
push eax
push 1
push dword [ebx + 0xc]
call fcn.0053fe50
push dword [ebp - 0x54]
movzx eax, byte [ebx + 0x10]
lea esi, [ebx + 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x58]
push edi
call fcn.0053ba70
mov ebx, eax
mov eax, dword [ebp - 0x5c]
push edi
movzx ecx, byte [eax + 0x18]
push ecx
push dword [eax + 0x30]
movzx ecx, byte [eax + 0x2c]
push dword [eax + 0x14]
push ecx
push 0
push dword [eax + 0xc]
call fcn.0053fe50
mov eax, dword [ebp - 0x5c]
add esp, 0x50
mov ecx, dword [ebp + 0x10]
add ecx, ebx
mov dword [ebp - 0x60], ecx
push dword [ebp - 0x54]
movzx eax, byte [eax + 0x10]
push eax
push esi
push ecx
push dword [ebp - 0x58]
push edi
call fcn.0053ba70
mov edi, dword [ebp - 0x5c]
add esp, 0x18
mov dword [ebp - 0x64], eax
xor esi, esi
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
call edx
test al, al
jne 0x538b6c
mov eax, 2
mov dword [ebp - 0x50], vtable.icu_64::UnicodeString.0
mov word [ebp - 0x4c], ax
push dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
push 0xd
push esi
push esi
push eax
push dword [ebp - 0x60]
mov eax, dword [ebp + 0xc]
add eax, ebx
mov dword [ebp - 4], esi
push eax
call fcn.005ac4b0
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.004df200
push dword [ebp - 0x54]
lea eax, [esi + ebx]
push dword [edi + 0x1c]
mov edi, dword [ebp - 0x64]
add eax, dword [ebp + 0x10]
push edi
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call fcn.005a8ee0
lea eax, [esi + edi]
add esp, 0x1c
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f4480
mov esp, ebp
pop ebp
ret 0x10
Function at 0x53c970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edx, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
lea edi, [ecx + 0x98]
mov dword [edx + 4], eax
lea esi, [edx + 0x9c]
mov eax, dword [ecx + 8]
mov ebx, 6
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x24]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 0x34]
mov dword [edx + 0x34], eax
mov eax, dword [ecx + 0x38]
mov dword [edx + 0x38], eax
mov eax, dword [ecx + 0x3c]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0x44]
mov dword [edx + 0x44], eax
mov eax, dword [ecx + 0x48]
mov dword [edx + 0x48], eax
mov eax, dword [ecx + 0x4c]
mov dword [edx + 0x4c], eax
mov eax, dword [ecx + 0x54]
mov dword [edx + 0x54], eax
mov eax, dword [ecx + 0x58]
mov dword [edx + 0x58], eax
mov eax, dword [ecx + 0x5c]
mov dword [edx + 0x5c], eax
mov eax, dword [ecx + 0x64]
mov dword [edx + 0x64], eax
mov eax, dword [ecx + 0x68]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 0x6c]
mov dword [edx + 0x6c], eax
mov eax, dword [ecx + 0x74]
mov dword [edx + 0x74], eax
mov eax, dword [ecx + 0x78]
mov dword [edx + 0x78], eax
mov eax, dword [ecx + 0x7c]
mov dword [edx + 0x7c], eax
mov eax, dword [ecx + 0x84]
mov dword [edx + 0x84], eax
mov eax, dword [ecx + 0x88]
mov dword [edx + 0x88], eax
mov eax, dword [ecx + 0x8c]
sub ecx, edx
mov dword [edx + 0x8c], eax
mov dword [ebp - 4], ecx
nop dword [eax + eax]
cmp byte [esi], 0
je 0x53ca63
push dword [esi - 8]
call fcn.00505ef0
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [edi]
lea edx, [edi + 8]
mov dword [esi - 4], eax
mov al, byte [ecx + esi]
mov byte [esi], al
mov eax, dword [edi - 4]
cmp eax, edx
jne 0x53ca8f
lea ecx, [esi + 4]
mov dword [esi - 8], ecx
mov eax, dword [edi]
shl eax, 2
push eax
push edx
push ecx
call fcn.005f7171
add esp, 0xc
jmp 0x53ca9f
mov dword [esi - 8], eax
mov dword [edi - 4], edx
mov dword [edi], 3
mov byte [ecx + esi], 0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x10], eax
cmp byte [esi + 0x1c], 0
je 0x53cab6
push dword [esi + 0x14]
call fcn.00505ef0
add esp, 4
mov eax, dword [edi + 0x1c]
lea edx, [edi + 0x22]
mov dword [esi + 0x18], eax
mov al, byte [edi + 0x20]
mov byte [esi + 0x1c], al
mov eax, dword [edi + 0x18]
cmp eax, edx
jne 0x53cae4
lea ecx, [esi + 0x1e]
mov dword [esi + 0x14], ecx
mov eax, dword [edi + 0x1c]
add eax, eax
push eax
push edx
push ecx
call fcn.005f7171
add esp, 0xc
jmp 0x53caf5
mov dword [esi + 0x14], eax
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], 4
mov byte [edi + 0x20], 0
mov ecx, dword [ebp - 4]
add edi, 0x34
add esi, 0x34
sub ebx, 1
jne 0x53ca50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [eax + 0x1c8]
mov dword [ecx + 0x1c8], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x549380
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b66bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], eax
push edi
mov edi, dword [eax + 4]
xor esi, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0xffffffff
call fcn.004e0e70
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ecx + 4], eax
jge 0x54946f
mov edx, dword [ebp + 8]
cmp esi, dword [ebp + 0x18]
jg 0x54946c
movzx ecx, word [edx + 4]
test cx, cx
js 0x5493ee
movsx eax, cx
sar eax, 5
jmp 0x5493f1
mov eax, dword [edx + 8]
cmp edi, eax
jae 0x549406
lea eax, [edx + 6]
test cl, 2
jne 0x549400
mov eax, dword [edx + 0x10]
movzx ecx, word [eax + edi*2]
jmp 0x54940b
mov ecx, 0xffff
cmp cx, word [ebp + 0x10]
jne 0x54942d
test esi, esi
jne 0x54941c
cmp dword [ebp - 0x10], esi
je 0x54946c
jmp 0x549462
cmp dword [ebp + esi*4 - 0x10], 0xffffffff
jne 0x54946c
mov dword [ebp + esi*4 - 0x10], 0
jmp 0x549462
mov ebx, dword [ebp + esi*4 - 0x10]
cmp ebx, 0xffffffff
je 0x54946c
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x54946c
movzx ecx, cx
sub ecx, 0x30
js 0x54946c
mov eax, dword [ebp + esi*4 - 0x1c]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
mov dword [ebp + esi*4 - 0x1c], eax
lea eax, [ebx + 1]
mov dword [ebp + esi*4 - 0x10], eax
cmp eax, 2
jl 0x549462
inc esi
inc edi
cmp edi, dword [ebp - 0x24]
jl 0x5493d4
mov ebx, dword [ebp - 0x1c]
xor ecx, ecx
xor edx, edx
or eax, 0xffffffff
cmp dword [ebp - 0x10], ecx
je 0x5494e5
cmp ebx, 0x17
jle 0x54949e
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
imul edx, eax, 0x36ee80
xor eax, eax
lea ecx, [eax + 1]
jmp 0x5494e5
mov ecx, dword [ebp - 0x10]
xor eax, eax
imul edx, ebx, 0x36ee80
cmp dword [ebp - 0xc], 2
jne 0x5494e5
mov esi, dword [ebp - 0x18]
cmp esi, 0x3b
jg 0x5494e5
imul eax, esi, 0xea60
add ecx, 3
add edx, eax
cmp dword [ebp - 8], 2
mov eax, 1
jne 0x5494e5
mov esi, dword [ebp - 0x14]
cmp esi, 0x3b
jg 0x5494e5
imul eax, esi, 0x3e8
add edx, eax
add ecx, 3
mov eax, 2
cmp eax, dword [ebp + 0x14]
jge 0x549506
mov ecx, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov eax, dword [ecx + 4]
mov dword [ecx + 8], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f4480
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x20]
mov eax, edx
pop edi
pop esi
add dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005f4480
mov esp, ebp
pop ebp
ret
Function at 0x550200
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push dword [0x6b61fc]
xor bl, bl
mov byte [ebp - 4], bl
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x55023c
push str.true
push eax
call fcn.00509640
add esp, 8
movzx ecx, bl
test eax, eax
mov edx, 1
cmove ecx, edx
mov byte [ebp - 4], cl
mov esi, dword [ebp + 8]
push esi
push dword [ebp - 4]
push str.japanese
call fcn.005beab0
add esp, 0xc
mov dword [0x756d94], eax
cmp dword [esi], 0
pop esi
pop ebx
jg 0x550264
mov eax, dword [eax + 8]
mov dword [0x756da0], eax
mov esp, ebp
pop ebp
ret
Function at 0x594910
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
push esi
push edi
mov eax, dword [edx + 0x10]
mov esi, eax
shl esi, 8
test al, 0xc
je 0x594923
xor esi, dword [edx + 0x14]
mov edi, dword [edx + 0x2c]
xor ecx, ecx
xor esi, edi
test edi, edi
jle 0x59493f
mov eax, dword [edx + 0x28]
mov edx, dword [eax]
lea eax, [eax + 4]
shl edx, cl
inc ecx
xor esi, edx
cmp ecx, edi
jl 0x594931
pop edi
mov eax, esi
pop esi
ret

Function at 0x5a96e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ff968
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.icu_64::number::impl::MicroProps.0
lea esi, [edi + 0x78]
mov dword [edi + 8], 0
mov eax, 0xfffffffd
mov word [edi + 0x30], ax
mov ecx, esi
mov dword [edi + 0x3c], 0xfffffffe
or eax, 0xffffffff
mov dword [ebp - 4], 0
mov byte [edi + 0x50], 0
mov word [edi + 0x48], ax
mov dword [ebp - 0x14], esi
call fcn.005ead60
mov dword [esi + 0xc], vtable.icu_64::number::impl::EmptyModifier.0
mov eax, edi
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], vtable.icu_64::number::impl::EmptyModifier.0
mov byte [esi + 0x18], 1
mov dword [esi + 0x1c], vtable.icu_64::number::impl::MultiplierFormatHandler.0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [edi + 0xa8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5cef60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa238
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_64::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_64::UnicodeSet.0
mov dword [esi + 4], vtable.icu_64::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.005cfd40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41819f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x270], 0
lea eax, [ebp - 0x25c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x208
push 0
push eax
call fcn.0042f600
xor eax, eax
lea edi, [ebp - 0x26c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x46aa70]
test eax, eax
jne 0x418361
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00440141
cmp dword [ebp - 0x270], 0
lea eax, [ebp - 0x25c]
je 0x41829c
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x41825d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41823c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x418243
mov esi, 0x80004005
push esi
push 0x460
push 0x455990
call fcn.004038ba
push 0x4560b4
jmp 0x418375
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040347e
mov esi, eax
test esi, esi
jns 0x41827a
push 0x4560e8
jmp 0x418375
push 0x456130
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040379b
mov esi, eax
test esi, esi
jns 0x4182e4
push 0x456140
jmp 0x418375
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4182e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4182c3
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4182ca
mov esi, 0x80004005
push esi
push 0x46b
push 0x455990
call fcn.004038ba
push 0x456184
jmp 0x418375
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov esi, eax
or esi, 1
jge 0x4182ff
push 0x4561b0
jmp 0x418375
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x418332
mov esi, 0x8007000e
push esi
push 0x475
push 0x455990
call fcn.004038ba
push 0x4561d8
jmp 0x418375
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x25c]
push eax
push str._ls_ls_
push 0x46aa70
call fcn.00402022
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x41835c
push 0x45620c
jmp 0x418375
mov eax, dword [0x46aa70]
push 0
push eax
push ebx
call fcn.0040229e
mov esi, eax
test esi, esi
jns 0x41837d
push 0x45624c
push esi
call fcn.0043fb09
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd1f
leave
ret 8