joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9fb63f
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa8e508
cld
jmp 0x70642a
jmp 0xa488be
call fcn.00a1f25a
adc edi, 2
not cx
mov dword [esp], 0x321a0daf
dec dword [esp]
not si
call fcn.00a8127b
mov edi, 0x8a198b8e
lea ecx, [edi + edi*8 - 0x3be8be74]
mov di, word [ebp]
shl ecx, 0x89
mov edx, 0x53a8cd2a
mov dx, word [ebp + edx - 0x53a8cd28]
shl ecx, 0x2f
btr cx, cx
setb cl
xor cl, byte [ebp + 4]
push 0xf4b0dab2
not word [esp + 1]
add ebp, 4
shld di, dx, cl
not dword [esp]
mov word [ebp], di
lea esp, [esp + 4]
jmp fcn.00af8aeb
push 0xb2159096
shrd ebp, edx, cl
mov dword [esi], ebp
jmp 0x696064
jae 0xacc28f
push 0x131133b2
sal dword [esp], 0xd
adc esi, 6
and byte [esp], 0x8a
jp 0x9ae34f
mov edx, dword [edi]
mov ecx, 0x9d970d26
bt cx, cx
mov cx, word [edx]
jae 0x72a878
jmp 0x9fe9b1
jmp 0xa2c38c
xor eax, edx
and eax, 0xff
jmp 0xa0e889
mov dword [esp], 0x1d9f3207
rep movsb byte es:[edi], byte [esi]
push dword [esp + 4]
popfd
push 0xbd19a38d
mov esi, dword [esp + 0xc]
and al, 0xc
mov edi, 0x308c1030
mov edi, dword [esp + edi*2 - 0x61182050]
call fcn.009efe13
mov eax, dword [esi]
mov ecx, 0xa435b0ae
push ecx
mov cl, byte [esi + 4]
add esi, 2
neg dword [esp]
shr eax, cl
call fcn.00af7704
adc bl, byte [edx - 0x43149aee]
dec esp
push cs
lcall 0x49d9, 0x5fe111af
leave
dec edi
and byte [esi - 0xe9ee17], ah
test eax, 0x7d7acd4b
lds edx, [ebx + 0x51948c3d]
and eax, 0xf3afa9d1
dec eax
mov word [edi - 0x53], es
cmp edx, esp
jb 0xa488ee
cmpsb byte [esi], byte es:[edi]
jmp 0xaaa39f2d
in eax, 0x25
cmpsb byte [esi], byte es:[edi]
loopne 0xa488d4
dec ecx
daa
jae 0xa48972
xchg edi, eax
xor eax, edx
popal
mov es, word [esi]
lea ebx, [edi + 0x1a]
jg 0xa48916
invalid
dec edx
sbb edi, dword [eax + ebp*8 + 0x45]
fcmove st(0), st(0)
jmp dword [edi]
jmp 0xacb619
lea esp, [esp + 8]
jmp fcn.006f202f
jae 0x6ca042
mov ecx, 0x3d87e732
mov edx, ecx
lea eax, [edx + ecx*2 + 0x5231309c]
mov ax, word [ecx + esi - 0x3d87e732]
btr ecx, 0x2c
sar ecx, 1
adc dl, dl
mov dx, word [ecx + esi - 0x1ec3f397]
mov cl, byte [esi + ecx*4 - 0x7b0fce60]
call fcn.009a4345
js 0x99a15d
Function at 0xa348f1
Capabilities:
Encode data using xor

Disassembly:
sub ecx, dword [esi + 0x32c4431]
invalid
call fcn.00a7e28a
xchg esp, eax
cdq
add al, 0
pop ebx
mov ecx, 0x25508c6d
mov word [eax + 0x25], ss
push ecx
aam 0x40
rcr dword [ebp - 0x5c], 0x68
add dword [ebp - 0xc], ebp
js 0xa34911
jne 0xa348f2
dec esp
das
push ds
daa
mov bl, 0xb1
stc
outsb dx, byte [esi]
or byte [ebp + eax*4 + 0x3b890161], bl
rcl byte [eax - 0x3e]
inc eax
js 0xa348f9
push eax
ret 0x7840
jl 0xa3491b
pop ebp
outsd dx, dword [esi]
and dl, byte [ebx]
cmp cl, byte [eax + 0x678d210e]
cmp al, 0x46
jnp 0xa349a6
mov ebx, 0x8f0a9617
sbb edi, esi
sub dl, bl
pop ds
xchg byte [edx], cl
arpl word [edi], cx
sahf
and bh, byte [edi + 0x753a8e1b]
jl 0xa348d7
jge 0xa348f4
and al, 0x24
invalid
mov word [edi - 0x7ae6d140], cs
or ebx, dword [eax]
sub ah, byte [edi + 0x36]
pop edi
xchg ebp, eax
inc ebx
or al, 0xe0
cmp al, byte [ecx + 0x5b]
push cs
sub ebp, esi
adc ah, al
cmp eax, 0x51c86cf1
fnsave dword [eax + ebx*8 - 0x2b9706b3]
sbb dword [edx + 0x5719e96a], 0xffffff9a
and dword [edi], 0x24
xor eax, 0x62552802
fistp word [ecx + edi*8 + 0x1e6ad83d]
imul ebx, dword [edi], 0x1d
stc
xchg esi, eax
sbb dword [eax - 0x6e17718c], ebp
xor al, 0x5a
sub byte [ebx - 0x16], 0x18
sar byte [edx - 0x57], cl
push edx
push edx
add al, 0x25
test eax, 0x25045252
mov eax, dword [0xfd561aff]
push es
push es
push eax
jno 0xa34958
pop esi
adc bh, byte [ecx - 0x75910dbe]
popfd
mov esp, 0xcf836638
mov cs, word fs:[ebp - 0x303a7da]
in eax, 0x36
cmovno esp, dword [esi + 0x6b]
lodsd eax, dword [esi]
in eax, 0xbe
mov esp, 0x9c9d9337
pop edx
invalid

Function at 0xa38e84
Capabilities:
Encode data using base64

Disassembly:
ror al, 1
mov dword [esp + 4], 0xea17d81d
xor al, 0xa0
mov dword [esp], 0xde1033b8
not word [esp + 9]
shr byte [esp + 7], 0xa4
not al
neg dword [esp + 8]
jno 0xa78673
sete byte [esp]
dec al
push 0x3b9eab4
xor bl, al
push 0xa8b8faae
call fcn.0069cafb

Function at 0xa4343e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], ebx
mov ebx, 0x1eb37e88
and bl, bh
ror ebx, 0xfc
movzx ebx, byte [eax]
jne 0xaf0c95
xor ebx, ebp
call 0x9a4e5e
pop esp
int3
Function at 0xa5d348
Capabilities:
Encode data using xor

Disassembly:
jl 0x746117
syscall
call fcn.0072a517
dec ebx
lea edx, [ebp + ebp - 0x28df6577]
dec esp
mov edx, dword [esp + 8]
dec esp
mov eax, dword [esp + 0x10]
dec esp
mov esp, dword [esp + 0x18]
inc ecx
mov ebx, 0x3194458f
dec edx
mov dword [esp + ebx - 0x3194457f], 0x711d7505
dec esi
mov ebp, dword [esp + ebx - 0x3194456f]
dec edx
mov eax, dword [esp + ebx*2 - 0x63288af6]
inc edx
movsx ecx, word [esp + ebx - 0x3194457e]
inc esp
mov ecx, edx
dec edx
mov ebx, dword [esp + ebx - 0x3194455f]
inc edx
rol dword [esp + ebx - 0x3194457f], 0xa5
dec eax
btr edx, ecx
dec edx
mov edx, dword [esp + ebx - 0x31944557]
inc esi
movsx esi, word [esp + ebx*2 - 0x63288b0e]
dec edx
lea ebp, [ebx*2 - 0x52c9e97d]
dec edx
mov dword [esp + ebx - 0x31944577], 0x9605429e
dec edx
mov ecx, dword [esp + ebx - 0x3194454f]
inc ecx
movzx edi, cx
dec esi
mov dword [esp + ebx*2 - 0x63288b1e], ecx
dec edx
mov edi, dword [esp + ebx - 0x31944547]
push dword [esp + 0x50]
popfd
inc ecx
push ecx
call fcn.00a729de
mov ecx, 0x687d298
lea eax, [ecx*8 + 0x1ea6b50f]
mov eax, dword [edi + ecx*2 - 0xd0fa530]
xor cl, 0x2a
dec edi
rcr byte [edx - 0x10], 1
xor cl, 0x2a
setne cl
mov ecx, dword [edi + ecx*2 - 0xd0fa3fe]
dec edi
add bl, byte [eax + esi*8 - 0xe]
jno 0xa4c4b2
sub eax, 0x8aef3672
xchg esi, eax
sub cl, byte [ebp + 0x4da4b977]
add ah, bl
sal bh, 0xd5
mov ecx, dword [esi + 0x67]
mov ah, byte [edi]
test edi, eax
test edi, eax
sub dword [edi + 0x56e0c5c8], eax
xor eax, 0xbd45b6ba
mov dh, 0x3a
stc
push ss
jg 0xa5d385
mov word [esi - 0x786db936], ss
or eax, 0x87e045d2
aad 0xde
sub dword [edx - 0x3836032b], 0xffffffb1
jecxz 0xa5d3d4
and dh, byte [eax + 0x1be164aa]
rcr dword [esi - 0x6b1de0f], cl
movsb byte es:[edi], byte [esi]
and byte [edi + 0x2e24b0e], bh
jecxz 0xa5d356
sbb edx, ebx
sahf
jno 0xa5d429
jge 0xa5d363
retf 0x6836
pop ecx
ljmp 0xfef4
adc dword [ebp - 0x2e], 0xc7944909
fld qword [edi]
mov dl, 0xfc
push ss
adc ch, ch
ljmp 0x1bb2

Function at 0xa6bef8
Capabilities:
Encode data using base64

Disassembly:
sub al, dl
shr ebp, 0x81
neg al
sar edx, 0xeb
or ebp, ebp
sbb al, 0xb2
rol edx, 0x6a
rol al, 1
shr ebp, 0x44
xor al, 0xa1
ror edx, 0x65
xor bl, al
push edi
push ebx
shl bp, 0x41
sub ebp, edx
btc dx, bp
mov ebp, esi
mov ebx, edx
bswap ebx
shl edx, 0xa5
mov ebx, eax
call fcn.00a6a91f
xor al, 0x33
push 0x1529762d
add al, 0x1f
mov dword [esp + 4], 0x7a0c791a
call fcn.006fd363
call eax
mov esi, 0x2e2d6233
mov ebp, dword [ebp + esi - 0x2e2d6237]
mov ebx, esi
xchg ebx, esi
push ebx
mov dword [esi + ebp - 0x2e2d6233], eax
call fcn.00a3705f
mov edx, 0x29b84407
or edx, edx
movzx eax, byte [edi + edx*2 - 0x5370880e]
shl edx, 0x2d
push edx
xor edx, edx
lea edi, [edx + edi + 1]
shr edx, 0x4e
or dword [esp + edx], 0x6fa1692b
xor al, bl
pop ebp
dec edx
jle 0x6f15d4
Function at 0xa999d6
Capabilities:
Encode data using xor

Disassembly:
neg dword [esp + 4]
xor byte [esp + 3], 0xb6
dec dl
push 0xf83e732e
clc
ror dl, 1
sub dl, 0x3d
xor bl, dl
shr byte [esp + 4], 0xe6
lea edx, [esp + edx + 0x10]
jne 0x6d6611
imul eax, dword [ebx + edx*2 - 0x6d], 0x2291ce2
sub ecx, ebp
mov ah, 0x4a
push ebx
js 0x6d5665
mov ebx, 0x2e0514ea
and dword [edx + 0x25], ebx
test al, 0x3a
push edi
mov byte [0x1d0c516f], al
aad 0xb
fnstsw word [edx + 0x8b111f9]
xchg byte [esi + 0x6ec9d236], ah
xor byte [edx - 0x7a], ch
or eax, 0xda1ec9d6
int 0x62
adc al, 0x7e
ret 0x5e29
sub dword [esi + 0x67], ebx
pop eax
cwde
std
add esp, dword [edx]
or dword [edx], esp
loop 0x6d55c4
pop ebp
dec edi
pushal
mov al, byte [0xd260ff1]
cmp bh, byte [ecx]
push ss
pop ebp
invalid
cli
fmul qword [edi - 0x42d6e670]
out dx, al
cmp dword [edi + 0x3d], esp
movsd dword es:[edi], dword [esi]
jbe 0x6d5615
xchg edx, eax
popal
popfd
mov ah, byte [0x6ead2d6f]
invalid
xor ecx, dword [edi - 0x61]
loop 0x6d5665
add eax, 0x8ce0d833
lea ecx, [ebx]
or ecx, dword [ebx + esi*8 - 0x41765d55]
and dl, byte [0xee9154d6]
clc
lcall 0x1fe5, 0x443904
cmp ah, ah
wait
fcmovnb st(0), st(6)
xchg byte [ecx - 0x23], dl
sbb byte [0x2ac133e4], dl
jl 0x6d56d6
inc ebp
loope 0x6d563a
mov ebx, 0x88767b23
stc
pop ebp
inc esp
sbb al, 7
invalid
dec eax
dec ebp
inc bp
or dl, byte [ebx]
dec ebx
xor cl, ah
leave
pop ebx
or byte [ebx], ch
jmp 0x6d566f
mov al, 0xf
lea esi, [esi - 0x1f]
add byte ss:[edi], cl
test edx, ecx
push edx
add eax, dword [eax]
movsx esp, byte [ecx - 0x7e7ac72e]
out dx, al
lcall 0xf6c1, 0x661e3ca4
or al, 0x8b
mov ah, 0x37
add al, 0x90
add ebx, dword [ecx + 0x2249aa68]
xor cl, byte [edi]
test esp, edx
int 5
add byte [esi - 9], ah
push esp
and al, 0xc
lea esp, [esp + 0x14]
jmp fcn.006cf2fc
jns 0x724272
sbb edi, dword [esi + eax]
test al, 0xe5
sbb al, 0x49
lds esp, [ecx - 0x8945b4a]
mov esi, 0xc4231e03
pop esi
loopne 0x6d65e1
pushfd
jno 0x6d65bb
and dword [edi - 0x29c0ed04], eax
wait
daa
imul edi, esp, 0xffffffd4
popal
bnd jmp 0x5af11d07
mov byte [edx], al
call fcn.0072910b
xor dl, bl
push 0xe0f909b
dec dl
mov dword [esp + 4], 0xbe02c686
mov dword [esp + 8], 0xdd3a2c1c
rol dl, 1
jmp 0x6d55b5
Function at 0xaa659d
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [esi + 2]
jmp 0xa4a91d
mov cx, word [esi]
add esi, 2
sub ebp, 1
mov eax, 0x9b1e7d9c
shr ax, 0x29
setbe al
movzx eax, byte [ebp]
jns 0xa28a45
mov eax, 0xaf8f4a3d
movzx ax, byte [esi]
jmp 0x727aea
push 0xb197a403
shr dword [esp], 0xdd
xor al, bl
sub al, 0xf
shr dword [esp], 0x15
or dword [esp], 0x82290d9c
jne 0xa91b27
push ss
xor eax, 0xdc1c072c
cmp dword [edi + 0x6e], 0xe3925245
sbb eax, 0xf8382b00
cmp dword [edi + 0x4a], 0xede958a
and dword [ebp - 0x7f12803b], edi
pushal
mov eax, 0xfbc8198d
mov bh, byte [edi + esi*8]
add eax, 0xdd527599
sbb ecx, 0x55
sahf
jns 0xa28ae7
adc dword [ebp + 0x4e], 0x25e1a3e9
sahf
sbb ebp, dword [ebp + ebx*8 + 0x5c2dedf6]
mov byte [0x5393b49f], al
xor cl, ah
leave
loop 0xa28a9b
dec esi
jmp 0x9ec86c44
sub dword [edx + ebp*4 - 0x41], edx
invalid
xchg esp, eax
sub byte [edi + eax], 0x80
neg byte [eax + edi - 0x63fceb3d]
sub byte [edi - 0x48], al
xchg byte [eax + ebx*2 - 0xf7e451d], bl
fcmovne st(0), st(0)
or byte [ebp + 0x78], ch
dec edi
out 0x47, al
inc edi
jae 0xa28ac9
loop 0xa28adf
mov edx, 0x2de11a6e
dec esi
push edx
out 0x32, eax
mov ebx, 0xea2a0de2
invalid
jmp 0xa7b8fb
call 0x714c67
lea esp, [esp + 0xc]
jmp fcn.0069f65b
call fcn.009922cd
jmp 0x73958a
Function at 0x61a45930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x54]
mov edx, dword [ebx]
test edx, edx
jle 0x61a4594d
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ecx + 0x30c]
test eax, eax
je 0x61a45941
mov eax, dword [esp + 0x50]
mov ebp, ecx
mov dword [esp], eax
call sym.icu_53::MessagePattern::validateArgumentName_icu_53::UnicodeString_const_
cmp eax, 0xffffffff
mov edi, eax
jl 0x61a45aca
lea eax, [ebp + 0x2b0]
mov edx, dword [ebp + 0x2d4]
xor esi, esi
mov dword [esp + 0x2c], eax
add esi, 1
mov ebx, esi
shl ebx, 4
jmp 0x61a4599b
add ebx, 0x10
cmp eax, 1
je 0x61a45941
add esi, 1
mov eax, dword [edx + ebx]
cmp eax, 5
jne 0x61a45990
lea eax, [esi + 1]
shl eax, 4
add edx, eax
cmp dword [edx], 8
je 0x61a459ce
movsx eax, word [edx + 0xa]
cmp edi, eax
sete al
test al, al
jne 0x61a45a14
mov edx, dword [ebp + 0x2d4]
mov eax, dword [edx + ebx + 0xc]
cmp esi, eax
cmovl esi, eax
jmp 0x61a45982
mov eax, dword [edx + 4]
mov dword [esp + 0x24], eax
movzx eax, word [edx + 8]
mov word [esp + 0x2a], ax
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0xc]
movsx eax, byte [eax + 0x1e]
test al, al
js 0x61a45a6c
mov ecx, dword [esp + 0x50]
movzx edx, byte [ecx + 0x1f]
test dl, 1
je 0x61a45aba
movzx eax, byte [ebp + 0x2cf]
and eax, 1
xor eax, 1
test al, al
sete al
test al, al
je 0x61a459bd
mov eax, dword [ebp + 0x30c]
test eax, eax
je 0x61a45941
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._uhash_iget_53
test eax, eax
mov ebx, eax
je 0x61a45941
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.icuin53.dll_typeinfo_for_icu_53::MessageFormat::DummyFormat
mov dword [esp + 4], sym.icuin53.dll_typeinfo_for_icu_53::Format
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
mov eax, 0
cmove eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [esp + 0x50]
movzx edx, byte [eax + 0x1f]
test dl, 1
jne 0x61a459fe
test ecx, ecx
jns 0x61a45ab8
xor eax, eax
and edx, 2
mov edx, dword [esp + 0x50]
je 0x61a45ac5
add edx, 4
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x2a]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym.icu_53::UnicodeString::doCompare_int__int__wchar_t_const__int__int__const
sub esp, 0x14
jmp 0x61a45a0b
mov eax, ecx
xor ecx, ecx
and edx, 2
mov edx, dword [esp + 0x50]
jne 0x61a45a88
mov edx, dword [edx + 4]
jmp 0x61a45a8b
mov dword [ebx], 1
jmp 0x61a45941
Function at 0x61a45ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x54]
mov edx, dword [eax]
test edx, edx
jle 0x61a4600f
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [esp + 0x50]
mov edi, ecx
mov dword [esp], eax
call sym.icu_53::MessagePattern::validateArgumentName_icu_53::UnicodeString_const_
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jl 0x61a4618e
mov edx, dword [edi + 0x2d4]
lea eax, [edi + 0x2b0]
xor esi, esi
mov dword [esp + 0x2c], eax
mov ecx, edx
mov edx, esi
lea esi, [edx + 1]
mov ebx, esi
shl ebx, 4
jmp 0x61a4605b
add ebx, 0x10
cmp eax, 1
je 0x61a46005
add esi, 1
mov eax, dword [ecx + ebx]
cmp eax, 5
jne 0x61a46050
mov eax, dword [esp + 0x58]
mov eax, dword [eax]
test eax, eax
jg 0x61a46005
lea eax, [esi + 1]
shl eax, 4
add ecx, eax
cmp dword [ecx], 8
je 0x61a460d0
movsx eax, word [ecx + 0xa]
cmp dword [esp + 0x20], eax
sete al
test al, al
je 0x61a460ba
test ebp, ebp
je 0x61a46112
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x10]
test eax, eax
je 0x61a46131
mov edx, dword [esp + 0x58]
mov dword [esp + 4], eax
mov ecx, edi
mov dword [esp], esi
mov dword [esp + 8], edx
call method.icu_53::MessageFormat.setCustomArgStartFormat_int__icu_53::Format__UErrorCode_
sub esp, 0xc
mov ecx, dword [edi + 0x2d4]
mov eax, dword [ecx + ebx + 0xc]
cmp esi, eax
cmovge eax, esi
mov edx, eax
jmp 0x61a46040
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], eax
movzx eax, word [ecx + 8]
mov word [esp + 0x2a], ax
mov eax, dword [esp + 0x50]
movsx ecx, byte [eax + 0x1e]
mov edx, dword [eax + 0xc]
movzx eax, byte [eax + 0x1f]
test cl, cl
js 0x61a46179
test al, 1
je 0x61a46142
movzx eax, byte [edi + 0x2cf]
and eax, 1
xor eax, 1
test al, al
sete al
jmp 0x61a46085
mov eax, dword [esp + 0x58]
mov dword [esp + 4], 0
mov ecx, edi
mov dword [esp], esi
mov dword [esp + 8], eax
call method.icu_53::MessageFormat.setCustomArgStartFormat_int__icu_53::Format__UErrorCode_
sub esp, 0xc
jmp 0x61a460ba
mov eax, dword [esp + 0x58]
mov dword [eax], 7
jmp 0x61a46005
mov ecx, edx
xor edx, edx
test al, 2
mov eax, dword [esp + 0x50]
je 0x61a46189
add eax, 4
mov dword [esp + 8], eax
movzx eax, word [esp + 0x2a]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym.icu_53::UnicodeString::doCompare_int__int__wchar_t_const__int__int__const
sub esp, 0x14
jmp 0x61a46108
test al, 1
jne 0x61a460fb
test edx, edx
jns 0x61a46140
xor ecx, ecx
jmp 0x61a46144
mov eax, dword [eax + 4]
jmp 0x61a4614f
mov eax, dword [esp + 0x58]
mov dword [eax], 1
jmp 0x61a46005
Function at 0x61a46240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax]
test eax, eax
jle 0x61a46271
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x61a46267
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
call dword [eax + 4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.icu_53::MessagePattern::validateArgumentName_icu_53::UnicodeString_const_
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
jl 0x61a463fc
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp + 0xc]
xor esi, esi
mov edx, dword [eax + 0x2d4]
add eax, 0x2b0
mov dword [ebp - 0x2c], eax
nop
mov eax, dword [ebp - 0x1c]
add esi, 1
mov ebx, esi
shl ebx, 4
mov ecx, eax
jmp 0x61a462bb
add ebx, 0x10
cmp eax, 1
je 0x61a462cf
add esi, 1
mov eax, dword [edx + ebx]
cmp eax, 5
jne 0x61a462b0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax]
test ecx, ecx
jle 0x61a462e0
test edi, edi
je 0x61a46267
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
jmp 0x61a46267
lea eax, [esi + 1]
shl eax, 4
add edx, eax
cmp dword [edx], 8
je 0x61a46360
movsx eax, word [edx + 0xa]
cmp dword [ebp - 0x20], eax
sete al
test al, al
je 0x61a4631a
test edi, edi
je 0x61a46331
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], edi
mov dword [esp], esi
xor edi, edi
mov dword [esp + 8], eax
call method.icu_53::MessageFormat.setCustomArgStartFormat_int__icu_53::Format__UErrorCode_
sub esp, 0xc
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x2d4]
mov eax, dword [edx + ebx + 0xc]
cmp esi, eax
cmovl esi, eax
jmp 0x61a462a0
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x61a463a5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
mov edi, eax
jne 0x61a462ff
mov eax, dword [ebp + 0x10]
mov dword [eax], 7
jmp 0x61a46267
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
movzx eax, word [edx + 8]
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
movsx eax, byte [eax + 0x1e]
test al, al
js 0x61a463e3
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x1f]
test dl, 1
je 0x61a463af
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x2cf]
mov byte [ebp - 0x24], al
and eax, 1
xor eax, 1
test al, al
sete al
jmp 0x61a462f7
mov edi, dword [ebp + 0xc]
jmp 0x61a462ff
mov eax, ecx
xor ecx, ecx
and edx, 2
mov edx, dword [ebp + 8]
je 0x61a463f7
add edx, 4
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x26]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym.icu_53::UnicodeString::doCompare_int__int__wchar_t_const__int__int__const
sub esp, 0x14
jmp 0x61a4639b
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0x1f]
test dl, 1
jne 0x61a46388
test ecx, ecx
jns 0x61a463ad
xor eax, eax
jmp 0x61a463b1
mov edx, dword [edx + 4]
jmp 0x61a463bc
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x61a46255
Function at 0x61a466d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x6c
mov eax, dword [ecx + 0x2d8]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], eax
mov eax, ebx
shl eax, 4
add eax, dword [ecx + 0x2d4]
lea ecx, [ebp - 0x38]
mov eax, dword [eax]
mov dword [esp + 8], 5
mov dword [esp + 4], 0x61c05174
mov dword [esp], 0
sub eax, 0xc
cmp eax, 2
adc ebx, 0
call sym.icu_53::UnicodeString::UnicodeString_signed_char__wchar_t_const__int_
lea eax, [esi + 0x2b0]
sub esp, 0xc
mov edx, dword [esi + 0x2d4]
mov dword [ebp - 0x4c], eax
jmp 0x61a4677d
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax + 0x2cf]
mov byte [ebp - 0x40], al
and eax, 1
xor eax, 1
test al, al
je 0x61a467f0
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0x2d4]
lea eax, [edx + edi + 0x10]
mov ecx, dword [eax]
sub ecx, 0xc
cmp ecx, 1
jbe 0x61a46804
mov ebx, dword [eax + 0xc]
cmp esi, ebx
cmovge ebx, esi
add ebx, 1
cmp dword [ebp - 0x48], ebx
jle 0x61a46820
mov edi, ebx
lea esi, [ebx + 1]
shl edi, 4
add edx, edi
cmp dword [edx], 6
je 0x61a46820
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
movzx eax, word [edx + 8]
movzx edx, byte [ebp - 0x19]
mov word [ebp - 0x42], ax
movsx eax, byte [ebp - 0x1a]
test al, al
js 0x61a46824
test dl, 1
jne 0x61a46733
xor ecx, ecx
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x42]
and edx, 2
lea edx, [ebp - 0x34]
cmove edx, dword [ebp - 0x34]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], edx
mov dword [esp], eax
call sym.icu_53::UnicodeString::doCompare_int__int__wchar_t_const__int__int__const
sub esp, 0x14
test al, al
jne 0x61a4674e
nop
lea esi, [esi]
lea ecx, [ebp - 0x38]
call sym.icu_53::UnicodeString::UnicodeString__
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea eax, [edx + edi + 0x20]
lea esi, [ebx + 2]
mov ebx, dword [eax + 0xc]
cmp esi, ebx
cmovge ebx, esi
add ebx, 1
cmp dword [ebp - 0x48], ebx
jg 0x61a4677d
nop
xor esi, esi
jmp 0x61a467f0
test dl, 1
jne 0x61a46733
test ecx, ecx
jns 0x61a4684a
xor eax, eax
jmp 0x61a467b4
mov eax, ecx
jmp 0x61a467b2

Function at 0x61a47cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.61a479cc
mov ebx, dword [esi]
invalid
Function at 0x61a47dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.61a479dc
push eax
push esi
push dword [ebp + 8]
call fcn.61a47991
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.61a479dc
push eax
push esi
push dword [ebp + 8]
call fcn.61a47991
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.61a479cc
dec edi
mov ecx, 0x9d8834ea

Function at 0x61a47fb0
Capabilities:
Inspect section memory permissions

Disassembly:
jge 0x61a47fc2
jmp 0x61a47fb9
call fcn.61a479cc
push esi
or ecx, dword [0x10458bc2]