joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5c0d
Capabilities:
Hash data using murmur3
Packed with generic packer

Disassembly:
jmp esi
shl cx, cl
bswap edx
shl ecx, 0x21
xor ebx, edx
rol ecx, cl
adc esi, edx
shl ecx, 0x64
jns 0x432f66
lea edx, [ecx*4 - 0x1cd8496e]
mov eax, dword [ecx + esi]
dec edx
lea esi, [esi + ecx*8 + 4]
sar ecx, 0x4b
inc edx
xor eax, ebx
sub edx, 0x48026838
xchg dx, cx
not eax
add edx, 0xe1aa81b6
call fcn.004ef9b3
mov eax, 0xd9961dac
movzx edx, ax
movsx ecx, dl
mov eax, dword [ebp + edx*4 - 0x76b0]
inc dx
shl ecx, cl
mov cx, word [edx + ebp - 0x1da9]
push edx
lea ebp, [edx + ebp - 0x1da7]
mov word [eax + edx*2 - 0x3b5a], cx
call fcn.00495227
not ecx
sbb ax, 0x4fb5
mul dword [esp]
shl edx, 0xa1
lea ecx, [ecx + eax*4 - 0x350457a5]
sbb dl, dl
bswap ecx
mov dword [esp + eax], 0xb3ebb3a
add dword [esp + eax*2], edx
sar eax, 0xb2
ror ecx, 3
bts edx, eax
cwd
dec ecx
sar dx, 0xe1
shr dl, 7
neg ecx
pop edx
or edx, eax
xor ebx, ecx
add esi, ecx
mov ecx, dword [edi + eax*2]
neg edx
btc edx, 0x8d
bt dx, ax
or al, byte [eax + edi + 4]
btr edx, edx
lea edi, [edi + edx - 0x74c0b480]
bts edx, edx
mov byte ss:[ecx + edx - 0x74c0b4c6], al
sbb dx, dx
jp 0x476779
add esi, edx
cdq
push edx
mov dword [esp + eax - 0x33261d37], eax
mov edi, dword [edi + eax*2 - 0x664c3a76]
inc word [esp + edx*2 + 0xa]
xchg byte [esp + eax - 0x33261d34], al
lea ecx, [edx + eax + 0x73da934]
pop ecx
pop ecx
pop edx
js fcn.0042cb0f

Function at 0x4e8279
Capabilities:
Hash data using murmur3

Disassembly:
xor ecx, 0x90239bad
btr edx, 0x3b
not al
inc ecx
bswap ecx
cwde
imul dx
sal dl, 0x64
rol ecx, 1
sub eax, eax
sbb ecx, 0xf38eb28c
neg ecx
inc edx
imul word [esp + eax*2 + 6]
inc dl
inc ecx
neg ecx
dec ecx
mov dword [esp + eax + 8], edx
xor ebx, ecx
add edi, ecx
sar edx, 0x61
adc byte [esp + eax + 4], al
pop edx
pop edx
pop eax
jae fcn.004b99d8

Function at 0x4ea479
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ecx + ebp - 0x2f]
xor edx, ebx
neg al
cwde
ror eax, cl
lea edx, [edx + ecx*2 - 0x221c1410]
xor edx, 0x9f9b6ea3
ror cl, 0xe5
push ecx
lea edx, [edx + ecx + 0x12b3363f]
lea ecx, [ecx + eax*8 + 0xe1431bf]
neg byte [esp + ecx*2 - 0x3ea8646d]
adc ecx, 0x460d579e
neg edx
imul eax, eax
cwde
lea edx, [edx + ecx*2 - 0x31a5e7f4]
bswap eax
adc dword [esp + eax], eax
call fcn.0043336f
mov edi, dword [edi + ecx*4 - 0x6022e54]
bswap edx
pop edx
pop eax
jmp fcn.004d0428
mov eax, ebp
mov dword [esp + edx*8], edx
lea ebp, [ebp + edx*4 - 4]
pop edx
adc dx, 0xc19b
movzx ecx, dl
mov dword [ebp + edx*4 - 0x3066c], eax
movzx eax, cx
sub cx, ax
jle fcn.004ea950
mov ecx, esi
lea esi, [esi + edx*2 - 0x3c28]
jl 0x4cf2e2
mov word [edx + esi - 0x1e13], cx
dec word [esp + edx - 0x1e12]
pop eax
jl fcn.00523752
Function at 0x4ec438
Capabilities:
Hash data using murmur3

Disassembly:
add cx, 0x2ac
btr edx, ecx
neg eax
shl dx, cl
inc cl
ror eax, 1
inc eax
call fcn.004f908a
xor eax, ecx
lea edx, [ecx*8 + 0x11989ea0]
ror eax, 1
call fcn.00506e34
idiv eax
movsx ecx, dl
mov eax, dword [esi + eax*2 - 0x7a9e]
xor eax, ebx
shl ecx, cl
sbb ecx, ecx
add dl, cl
add eax, ecx
or ecx, edx
dec edx
jno 0x4b16b0
mov dword [ebp], edx
push eax
pop edx
pop edx
mov eax, dword [esi]
shr dl, cl
sub dl, ch
sub dl, dl
adc esi, 4
add dx, cx
and cl, 0x9f
jae 0x4d4222
movzx ax, byte [ebp]
mov ecx, 0xcdaa6f89
mov cl, byte [ebp + 2]
mov edx, 0xa8926b1e
add ebp, 2
call fcn.005252e4
sal dx, 3
lock xadd dword [edx + ecx], eax
push edx
call fcn.0044a3d6
xor eax, ebx
bt ecx, 0x19
bt dx, dx
cmovae dx, cx
dec eax
jmp 0x456b78
bt edx, eax
bts eax, edx
rol cx, 1
cwde
mov dword [esp + eax - 0x3e9a], 0x1139a584
imul dword [esp + eax - 0x3e9a]
not cx
seto dl
rol cx, 1
sal dx, 0x21
shl dl, 0x25
cwde
inc cx
pop eax
neg cx
xor bx, cx
btc ax, ax
lea edi, [edi + eax*2 - 0x22734b2a]
adc eax, eax
mov word [edi + eax - 0x22734b28], cx
lea esi, [eax + esi - 0x22734b2c]
ja 0x4cb55c

Function at 0x4f4fd8
Capabilities:
Encode data using base64

Disassembly:
not eax
mov dword [esp], 0xae20669b
jnp 0x510a08
neg eax
mov word [esp], cx
mov dword [esp + 4], ecx
shl edx, cl
rol eax, 1
xor ebx, eax
shl ecx, 0xa6
pop edx
jbe 0x522c5d
sar cx, 0x26
adc edi, edx
lea esi, [esi + eax - 0x4000f000]
movzx edx, word [esi + eax - 0x4000effe]
shl ecx, 0xa2
xor dx, bx
ror al, 0x44
setae al
not cl
sbb dx, 0x3ea4
btc eax, 0x17
sbb al, 0x12
xor dx, 0xaea4
not cl
dec dx
sal ax, 0x61
cwde
neg dx
rol dx, 1
xor ax, cx
jle 0x51b1e5
add eax, eax
mov edx, 0xe837d513
movzx edx, byte [edi]
or al, ah
xor dl, bl
call fcn.004f4f52
xor al, 0x3f
neg dx
inc dx
ror dx, 1
sub dx, 0x4aa3
neg dx
xor bx, dx
cbw
sub ebp, 4
sub eax, eax
mov dword [ebp + eax*4], edx
btc ecx, eax
jae fcn.0043bab6
add esi, eax
pop ecx
jmp fcn.0042cb0f

Function at 0x4f5003
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
sub edx, dword [esp + edx*4 - 0x2003fb]
xor ebx, ecx
rol eax, 0xdc
cbw
jb 0x4f3a8b
adc esi, ecx
sal byte [esp + 5], 0x81
mul edx
cdq
mov dword [esp + edx*2], esi
ret 8

Function at 0x4fbd21
Capabilities:
Hash data using murmur3

Disassembly:
not dword [esp + ecx - 0x7ffffff4]
neg edx
sub edx, 0xb33ba38e
sub byte [esp + ecx - 0x7ffffff3], cl
mov dword [esp + ecx - 0x80000000], 0x9b8db09f
not eax
neg edx
and ecx, ecx
mov dword [esp + ecx - 0x7ffffffc], eax
sub al, byte [esp + ecx - 0x7ffffff4]
bswap edx
neg ecx
add ecx, eax
xor ebx, edx
lea ecx, [eax*2 - 0x5c9d549]
btr cx, ax
adc edi, edx
pop edx
pop edx
pop eax
pop edx
jmp fcn.004e21c3

Function at 0x50763b
Capabilities:
Packed with generic packer

Disassembly:
pop eax
mov eax, 0x398f4438
lea ebp, [ebp + eax - 0x398f443c]
mov ecx, dword [ebp + eax - 0x398f4438]
mov edx, 0xa2a5ff26
lea edx, [eax*4 - 0x48cb5b5a]
xor ecx, ebx
xor ecx, 0xa3311024
inc ecx
rol ecx, 3
dec edx
bswap ecx
shr edx, 0xe7
not ecx
sbb ecx, 0x853abeab
jmp 0x50d153
Function at 0x510565
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov dword [esp], 0xcbb74139
cld
rep movsb byte es:[edi], byte [esi]
shl byte [esp + 1], 0x45
mov esi, dword [esp]
lea edi, [esi*2 - 0x68fa2751]
push dword [esp + 8]
popfd
mov esi, dword [esp + edi - 0x2e741915]
mov edi, dword [esp + edi*2 - 0x5ce83232]
lea esp, [esp + 0x14]

Function at 0x51096e
Capabilities:
Encode data using base64

Disassembly:
pop ecx
mov ecx, 0xdfa5331e
dec edx
btc eax, ecx
sub ecx, eax
xor ebx, edx
sal byte [esp + ecx - 0x2fa4331f], 0x27
or cx, ax
jae 0x51b122
rol dl, 0xc4
lea ecx, [edx*4 - 0x59ca0edd]
lea ebp, [ebp + edx - 0x38eeafba]
sub cl, dh
dec dx
lea esi, [esi + edx*2 - 0x71dd5f7b]
call fcn.00490f18
adc edi, edx
mov dword [esp + ecx*2 - 0x5f49fffe], edi
ret 0xc
Function at 0x5109af
Capabilities:
Encode data using base64

Disassembly:
not al
xor cl, cl
shl cl, 0x24
not dl
and al, dl
push ecx
mov word [ebp], ax
movzx edx, cx
sal dl, 3
mov eax, dword [edx + esi - 0xca00]
inc dx
or ecx, 0x5f9161b2
lea esi, [esi + edx*8 - 0x65004]
lea edx, [ecx*8 + 0x2f84bf02]
dec dx
adc cl, cl
xor eax, ebx
rol eax, 1
shr dl, cl
push edx
sbb eax, 0x9d8d4a1a
sar byte [esp + edx*2 - 0x58e8380e], cl
ror eax, 2
shr edx, cl
neg eax
shr cx, cl
dec byte [esp + edx*2 - 0x58e837b]
pop edx
bswap eax
pop edx
rol ecx, cl
jp 0x44ead2
jp 0x43e15f
mov esp, 0xb368f3af
test dword [ebp - 0x7e], ecx
or byte [ebx], al
call [edi - 0x5ead371c]
ror byte [ebx + 0x59], 1
clc
das
add dword [0x1fd5a226], edi
fcomi st(1)
cld
call 0xaac30556
pop ebp
fldcw word [esi + 0x4da9de24]
mov dh, 0xcd
imul edx, dword [ebx + edx + 0x353e685d], 0x6e
jge 0x43e1e3
test eax, 0x6bcdb64d
xchg esp, eax
adc ebx, dword [ebp + 0x68]
xor eax, 0x96f27d6e
xchg esi, eax
inc ebx
jo 0x43e186
mov ch, byte [edi + 0x7b]
xor bl, byte [esi + 0x5c]
cli
jb 0x43e270
or al, 0xb4
adc bl, dh
mov dl, 0x92
jae 0x43e244
sub dword ds:[edi], esi
sub dword [edi], esi
and esi, dword [ebp + 0x5e]
fild qword [ecx - 0x1f7c0a6c]
jge 0x43e205
add ebx, dword [edx]
mov dword [0x56b5b02a], eax
cmp ebx, dword [esi - 0x1d7d2df9]
jg 0x43e1e3
cmp al, 0xb
out 0x46, eax
jp 0x43e257
xor byte [ebx + 0xa5df1e6], ah
stc
jge 0x43e259
enter 0xffffffffffffcde9, 0xffffffffffffff9f
fisttp dword [esi]
or byte [ebx + 0x79518494], dh
inc edi
xor ah, dh
jle 0x43e21a
std
dec esi
neg dx
xor eax, 0x518ab41b
neg ecx
sub eax, ecx
dec edx
call fcn.00471a97
mov eax, dword [ebp]
mov ecx, 0x9a8831aa
inc esp
and eax, 0x31aab900
mov byte [edx - 0x531645f1], bl
add byte [ecx - 0x6577ce56], bh
bts ecx, 0xac
mov edx, dword [ebp + 4]
adc ecx, 0x6e264113
push ecx
xadd word [esp + ecx*2 - 0x115ce57a], cx
lea ebp, [ebp + ecx*4 - 0x22b822b4]
adc eax, edx
jmp 0x4ea2a0
ror dword [esp + ecx*2 - 0x115ce57a], 0x8d
lodsb al, byte [esi]
lea ecx, [ebp + ebx*8 + 0x47]
fst qword [ebx]
ret 0x1be9
inc eax
xor ebx, eax
dec edx
btc ecx, edx
sal ecx, 0x88
add edi, eax
rol dx, 0x48
jmp edi
lea edx, [ecx + ecx*2 - 0x28506651]
mov dword [ebp + ecx*2 - 0x115c115c], eax
mov edx, dword [edi + ecx*4 - 0x22b822b8]
lea edi, [edi + ecx*2 - 0x115c1158]
mov eax, 0x3e9fd290
dec ecx
xor edx, ebx
not edx
xadd dword [esp + ecx - 0x8ae08ad], ecx
cbw
sal ax, 0x6c
lea edx, [eax + edx + 0x14f8e5a4]
rol dword [esp + eax*2 - 0x7d3e0000], 0xaa
adc eax, eax
xor edx, 0xca8c5d28
add eax, ecx
sbb eax, ecx
bswap edx
lea edx, [edx + ecx - 0x3d2e1e24]
neg edx
not edx
div cl
or ecx, 0xbc2d1209
not dword [esp + eax - 0x7d3e0000]
xor ebx, edx
not dword [esp + eax - 0x7d3e0000]
neg ecx
sub cx, 0xcc06
add esi, edx
mov dword [esp + ecx*2 - 0x1258276], esi
ret
call fcn.004b081e
adc ebp, 2
imul cx, cx
jo 0x43e14e
mov ecx, 0x66b6419a
shl ecx, 0x48
movzx edx, cx
lea esi, [esi + edx - 0x9a04]
xor edx, edx
movzx eax, dx
ror al, 0xa6
xor edx, dword [esi + edx*2]
not ax
btc ax, cx
xor edx, ebx
xor edx, 0xe23b5b9a
lea edx, [edx + eax*8 - 0x7f1ecd94]
bts eax, eax
not edx
btr eax, 0xac
bswap edx
ror cx, 0x61
xor ebx, edx
Function at 0x516bbd
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov dword [ebp], edx
mov ecx, dword [esp + 4]
push ecx
xadd dword [esp + 8], ecx
sbb esi, 3
mov edx, dword [esi]
not dword [esp + 2]
jmp 0x47b674
shrd edx, eax, cl
mov dword [esp], 0xd60895a8
jmp 0x4481d3

Function at 0x519cca
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov dword [esp + edx], ecx
rol cx, cl
xor ax, 0x5db2
rol word [esp + edx + 2], cl
xor bx, ax
imul cx, dx
adc dword [esp + edx*4], 0xdb2f618f
bts ecx, 0x2d
lea ebp, [ebp + edx*2 - 4]
bswap ecx
rol ecx, 0x44
or dx, dx
mov dword [ebp + edx], eax
inc dword [esp + edx]
neg dword [esp + edx]
mov dword [esp + edx*2], 0x3ab438b7
pop ecx
jno fcn.004e21c3
mov edx, 0x9280b88f
movzx ecx, dl
mov edx, dword [ecx + ebp - 0x8f]
mov eax, dword [ebp + ecx - 0x8b]
mov cl, byte [ebp + ecx*2 - 0x116]
push 0xdd825915
add ebp, 6
call fcn.00516bbd
Function at 0x52138c
Capabilities:
Hash data using murmur3

Disassembly:
or dx, word [esp]
sbb cl, 0xa2
ror cl, 1
add cl, dl
imul edx, dword [esp]
rol cl, 1
inc cl
cwd
sal ax, 0x2e
xor cl, 0xb1
btc eax, 0x24
btr edx, 0x35
xor bl, cl
not edx
bts ax, ax
rol ecx, 3
imul edx, edx
cmovo eax, edx
btc eax, 0x13
sbb ecx, 0x9eb4e29b
xor ebx, ecx
lea ebp, [ebp + edx - 0x4b06af94]
mov dword [ebp + eax - 0x4b0eaf90], ecx
call fcn.004d5d75
mov edx, 0x96a92c89
mov esp, ebp
xor dl, dl
movsx ebp, dl
mov esi, ebp
pop ecx
call fcn.004342d9
lea edx, [ecx + edx - 0x80e6b70]
xadd al, cl
inc ecx
sal cx, 0x21
xor edx, 0x89b3d08a
btr ecx, ecx
jb 0x46d3be
lea edx, [edx + ecx - 0x15546f23]
imul ecx, eax
dec cl
xor ebx, edx
bt ax, cx
add ebp, edx
lea edx, [eax + ecx + 0x3baff507]
btr ax, 0x11
mov edx, dword [edi + eax - 0x23793d40]
sub eax, ecx
movzx cx, byte [edx + ecx - 0x7eb6108b]
btc eax, 8
push eax
inc byte [esp + 1]
adc edi, 2
mov word [edi], cx
pop edx
jmp ebp
jmp 0x5014d3
adc ecx, ecx
adc esi, edx
jmp esi
sar al, 0x81
and dl, dh
lea ecx, [ecx + edx*2 + 0x47c44611]
ror ecx, 3
shr al, 0xe7
shr eax, 0xed
ror edx, 0xe7
not ecx
jnp 0x446ad0
rol ecx, 1
neg edx
call fcn.00482c69
mov eax, 0x61bad30a
jmp 0x44b5e3
bswap edx
neg edx
btr cx, cx
jb 0x4ea6f6
bts cx, ax
xor edx, 0x3326eb03
ror eax, 0x1c
ror eax, cl
xadd ax, cx
neg edx
xor ebx, edx
xadd ecx, eax
jbe 0x4a62a3
mov edx, 0xe720eb26
movsx ecx, dl
movzx eax, byte [esi + ecx*4 - 0x98]
lea esi, [ecx + esi - 0x25]
lea ecx, [edx*4 + 0x4c30ce09]
rol cx, cl
xor al, bl
sal cx, cl
neg dx
inc dl
ror al, 1
bt ecx, ecx
sbb al, 0x83
add cl, dl
xor al, 0xad
rol ecx, cl
and ecx, 0x7833ea23
not ecx
neg al
push ecx
rol al, 1
dec dx
xor bl, al
lea ecx, [edx + edx*2 + 0x45313cb8]
sub dword [esp], ecx
sbb ecx, ecx
lea eax, [esp + eax + 4]
dec word [esp + 1]
mov edx, dword [eax]
push ecx
sar ecx, 0x99
sbb ebp, 3
shl ecx, cl
mov dword [ebp + ecx - 0x80000000], edx
mov edx, dword [ecx + esi - 0x80000000]
lea esi, [esi + ecx - 0x7ffffffc]
or dword [esp + ecx - 0x80000000], ecx
movsx eax, cx
call fcn.004815be
lea esi, [esi + edx - 0x67b5959c]
lea eax, [edx + edx*8 + 0x3f321595]
rol dx, 0x29
sal edx, 0x66
xor ecx, ebx
mul eax
sbb dl, ah
bts ax, dx
xor ecx, 0x90239bad
add al, dl
jp 0x504911
btr eax, eax
inc ecx
jmp 0x457145
mov ecx, dword [edi + eax*2 - 0x6527fb88]
idiv al
push eax
dec word [esp + eax - 0x3293e009]
xor ecx, ebx
sar edx, 9
setp al
sub eax, 0x45002835
rol ecx, 1
or dword [esp], edx
and edx, 0x8f8da931
neg ecx
sub ecx, 0xbe0f9f28
not dl
not byte [esp + 1]
div dl
neg ecx
xor ebx, ecx
add ebp, ecx
not eax
cwde
sub edi, 1
movsx ecx, dl
or dword [esp], edx
movzx ecx, byte [edi]
shl dword [esp], 0x21
xor cl, bl
btc eax, edx
jb 0x436e98
bts dx, dx
btr edx, 0x30
and cl, al
btr edx, 1
not cl
lea eax, [edx*8 - 0x734bcdfb]
pop eax
mov word [edi + edx - 0x36041034], cx
lea ebp, [ebp + edx*2 - 0x6c08206c]
sub dl, dl
mov edx, dword [ebp + edx - 0x36041000]
mov eax, dword [esp]
pop eax
bt eax, 0x17
xor edx, ebx
movsx ecx, ax
jmp 0x492c36
Function at 0x52707f
Capabilities:
Hash data using murmur3

Disassembly:
add edi, ecx
mov dword [esp + edx*2 - 0x6f6e], eax
inc dx
jno 0x4af40e
push eax
invalid
mov ebp, dword [ebp + edx*8 - 0x1bdd0]
sal eax, 0x21
push eax
pop ecx
pop eax
pop ecx
jle fcn.0043bab6
mov edx, 0xd322d198
jmp 0x4a7bd3
not ecx
ror word [esp + edx - 0x4b27c802], 0x63
sar edx, 0x31
cwde
xor ecx, 0x3335872f
mov dword [esp + edx - 0x2593], 0xc9b3fe3f
cdq
sub ecx, 0x4237d18f
xor edx, eax
xor ebx, ecx
shr dword [esp + edx*2 - 0x6ff2], 0x4a
btc edx, eax
jb 0x454c9a

Function at 0x527829
Capabilities:
Hash data using murmur3
Parse pe header

Disassembly:
mov eax, esp
mov edx, 0xde070daf
lea edx, [edx + edx - 0x39750272]
bt edx, 0xa
mov ecx, 0x60
lea edx, [edi - 0x80]
call fcn.00506e0e
cmp edi, edx
lea esp, [esp + 4]
ja 0x494b2e
jmp 0x42a6bc

Function at 0x52b1bf
Capabilities:
Hash data using murmur3

Disassembly:
add edi, ecx
dec eax
cdq
mov ecx, edx
pop eax
pop ecx
pop ecx
jmp edi
imul dword [esp + 6]
bswap ecx
mov dword [esp + edx - 1], edx
shl edx, 0x94
xor ebx, ecx
cwde
neg dword [esp + edx*4 - 0x3ffff8]
jns 0x49505e

Function at 0x52ba13
Capabilities:
Hash data using murmur3

Disassembly:
inc ecx
mov dword [esp + eax - 0xcfdc], eax
inc ax
bt eax, eax
xor ebx, ecx
jmp 0x453c80

Function at 0x52c273
Capabilities:
Hash data using murmur3

Disassembly:
and word [esp + ecx*4 - 4], 0x84b6
jns 0x4bcfb4
mov dword [esp], edx
or eax, ecx
xor dword [esp], edx
movsx ecx, dl
mov dword [ebp + ecx*4 - 4], eax
je 0x443b9c
mov eax, dword [esi + ecx*4 - 4]
lea esi, [esi + ecx*2 + 2]
xor dword [esp + ecx*8 - 8], ecx
xadd cl, ch
xor eax, ebx
call fcn.005227f7
setae dl
not eax
sbb dx, dx
lea edx, [edx + edx*8 - 0x22ebab80]
setno dl
not ecx
btr edx, edx
jae 0x47a24e
Function at 0x53053e
Capabilities:
Encode data using xor
Hash data using murmur3
Packed with generic packer

Disassembly:
xor bl, al
lea eax, [esp + eax + 4]
neg byte [esp + edx*2 - 0x9e00000]
mov edx, dword [eax + edx*4 - 0x13c00000]
sbb ebp, 4
mov dword [ebp], edx
pop edx
jmp fcn.004b99d8
rol edx, 1
sub edx, 0xf38eb28c
btr ecx, 0x18
rol byte [esp + eax - 0x4efffff6], 0x42
add cl, byte [esp + eax - 0x4efffffb]
neg edx
btc eax, ecx
ror eax, 0x12
inc edx
neg edx
dec edx
xor ebx, edx
neg byte [esp + eax*8 - 0x99f5]
inc eax
add edi, edx
add dword [esp + eax - 0x133b], ecx
pop edx
and eax, eax
movzx eax, byte [eax + esi - 0x1341]
shl ecx, 0xfc
rol dx, 0xaa
lea esi, [esi + edx - 0x4effffff]
xor al, bl
pop ecx
neg al
not al
ror ecx, cl
dec al
bswap edx
not al
rol word [esp + edx*4 - 0x13a], 0x2b
bswap ecx
ror edx, cl
sbb al, 0x81
sar byte [esp + edx*8 - 0x27800000], 0xa6
shl dword [esp + edx - 0x4f00000], cl
sar word [esp + edx - 0x4efffff], cl
neg al
mov byte [esp + edx*2 - 0x9dffffe], ch
neg cl
jnp 0x44efa2
mov edx, 0xf7a65db4
or dx, dx
ja 0x48b183
mov ecx, dword [ebp]
mov dx, word [ecx]
mov ecx, 0xa9c6300
movzx eax, cl
lea ebp, [ebp + ecx - 0xa9c62fe]
btr eax, eax
bt eax, ecx
cbw
mov word [ebp + ecx - 0xa9c6300], dx
jb 0x4f785c
and al, ah
cdq
or eax, dword [edi + ecx*2 - 0x1538c600]
call fcn.00500f08
shl dx, 9
jnp 0x4f812f
add esi, ecx
call fcn.004e4be1
xor ecx, ebx
push eax
btc eax, 0x19
not ecx
not edx
lea ecx, [ecx + edx*2 + 0x1ec57686]
imul eax
ror ecx, 1
shl edx, 0x81
rol dword [esp + edx - 0x800fc], 4
cwde
xor ecx, 0x9e351f27
call fcn.004f5003
add edi, 4
sal dword [esp + 4], 0xd8
and word [esp + 1], 0xf006
mov byte [esp + 4], 0x99
shld ax, dx, cl
mov edx, dword [esp + 2]
mov word [edi + edx*2 - 0x1332d80], ax
movsx eax, dx
add eax, 0x6c35df1f
movzx ecx, ax
mov dword [esp + edx*4 - 0x2665b00], ebp
ret 4
jl 0x517dbd
mov dword [esp + eax - 0x4f000000], eax
jbe 0x46ced0
add eax, eax
not edx
btc ax, ax
cwde
push ecx
dec edx
xor ax, cx
xor ebx, edx
xadd al, ah
and cx, word [esp + ecx - 0x312b80b7]
ror cx, 0xa
adc esi, edx
mov eax, dword [edi + ecx - 0x312b0a40]
sal byte [esp + ecx*2 - 0x6256147f], 0x84
mov ecx, dword [eax + ecx*2 - 0x62561480]
call fcn.004a3cbb
mov eax, 0x96030c01
sub esi, 4
mov ecx, dword [esi]
xor ecx, ebx
sub ecx, 0x78b7372d
movsx edx, al
neg edx
neg ecx
btr ax, dx
push edx
and al, 1
lea ecx, [ecx + eax - 0x6e463fe2]
btr edx, edx
setb byte [esp + edx - 0x7fffffff]
cdq
bswap ecx
xor dl, 0x88
push eax
or dl, 0x1a
xor ebx, ecx
shl word [esp + 1], 0x6c
xchg dword [esp + 4], eax
adc ebp, ecx
dec dx
mov ax, word [edi]
mov ecx, edx
bswap ecx
mov dx, word [edi + ecx - 0x7efffffd]
mov cl, byte [ecx + edi - 0x7efffffb]
jl 0x52e2e5
Function at 0x10011c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbb8f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1010e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.100a00ed
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x10011ce1
push eax
push esi
call fcn.100a03ce
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.100a00a0
int3
Function at 0x1001c380
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x1010e040]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
movzx ecx, cx
xor eax, eax
nop word [eax + eax]
cmp word [eax + 0x1010eb40], cx
je 0x1001c3c2
add eax, 0x14
inc edx
cmp eax, 0xd20
jb 0x1001c3a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009ee50
mov esp, ebp
pop ebp
ret
lea eax, [edx + edx*4]
lea eax, [eax*4 + 0x1010eb40]
test eax, eax
je 0x1001c40f
mov eax, dword [eax + 8]
mov ecx, 0x100e56f4
test eax, eax
cmovne ecx, eax
lea eax, [ebp - 0x404]
push ecx
push str.IME_language_changed_to:___s
push 0x200
push eax
call fcn.10017910
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x100e5738
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009ee50
mov esp, ebp
pop ebp
ret
Function at 0x1001cb00
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1001cb1f
imul eax, dword [ebp + 0xc], 0x108
push eax
push 0
push esi
call fcn.100a2620
add esp, 0xc
push dword [0x10115ad4]
mov dword [ebp + 0xc], 0
mov dword [ebp + 8], 0
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov edi, eax
test edi, edi
je 0x1001cb5b
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
call dword [sym.imp.IMM32.dll_ImmGetConversionStatus]
push edi
push dword [0x10115ad4]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx edx, ax
xor ecx, ecx
xor eax, eax
nop word [eax + eax]
cmp word [eax + 0x1010eb40], dx
je 0x1001cb8b
add eax, 0x14
inc ecx
cmp eax, 0xd20
jb 0x1001cb70
mov eax, 4
jmp 0x1001cb95
lea eax, [ecx + ecx*4]
lea eax, [eax*4 + 0x1010eb44]
mov eax, dword [eax]
sub eax, 2
je 0x1001cba4
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
test esi, esi
je 0x1001cce5
push 0x80
push str.IME_General
push esi
call fcn.100a5922
mov dword [esi + 0x100], 0x1011019c
add esp, 0xc
mov edx, dword [0x101101a8]
mov ecx, edx
mov eax, dword [0x101101a4]
or ecx, eax
and ecx, dword [ebp + 8]
test ecx, eax
je 0x1001cbe3
xor al, al
jmp 0x1001cbec
mov eax, edx
and eax, ecx
cmp eax, edx
sete al
push 0x80
lea edi, [esi + 0x108]
mov byte [esi + 0x104], al
push str.IME_BiasNames
push edi
call fcn.100a5922
mov dword [edi + 0x100], 0x1011012c
add esp, 0xc
mov edx, dword [0x10110138]
mov ecx, edx
mov eax, dword [0x10110134]
or ecx, eax
and ecx, dword [ebp + 8]
test ecx, eax
je 0x1001cc2f
xor al, al
jmp 0x1001cc38
mov eax, edx
and eax, ecx
cmp eax, edx
sete al
push 0x80
mov byte [edi + 0x104], al
lea edi, [esi + 0x210]
push str.IME_BiasSpeech
push edi
call fcn.100a5922
mov dword [edi + 0x100], 0x1011015c
add esp, 0xc
mov edx, dword [0x10110168]
mov ecx, edx
mov eax, dword [0x10110164]
or ecx, eax
and ecx, dword [ebp + 8]
test ecx, eax
je 0x1001cc7b
xor al, al
jmp 0x1001cc84
mov eax, edx
and eax, ecx
cmp eax, edx
sete al
push 0x80
add esi, 0x318
mov byte [edi + 0x104], al
push str.IME_NoConversion
push esi
call fcn.100a5922
mov dword [esi + 0x100], 0x1011011c
add esp, 0xc
mov edx, dword [0x10110128]
mov ecx, edx
mov eax, dword [0x10110124]
or ecx, eax
and ecx, dword [ebp + 8]
test ecx, eax
je 0x1001ccd6
xor al, al
mov byte [esi + 0x104], al
mov eax, 4
pop edi
pop esi
pop ebp
ret 8
mov eax, edx
and eax, ecx
cmp eax, edx
sete al
mov byte [esi + 0x104], al
pop edi
mov eax, 4
pop esi
pop ebp
ret 8