joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.1000ede0
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.1000ede0
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.1000ede0
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.1000ede0
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.1000ede0
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.1000ede0
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.1000ede0
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.1000ede0
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x1000ede0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000edef
pop dword [ebp - 0x48]
mov eax, 0x255c46fc
sub eax, 0x155b590d
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x72b692
add dword [ebp - 0x58], 0x4ddf8eb9
mov dword [ebp - 0x54], 0x776b5d61
sub dword [ebp - 0x54], 0x4538111c
mov dword [ebp - 0x50], 0x5368b198
add dword [ebp - 0x50], 0xf8e39296
mov dword [ebp - 0x4c], 0xf5e5fa56
sub dword [ebp - 0x4c], 0xf5e5fa56
lea eax, [ebp - 0x58]
push eax
mov eax, 0xb6d0fecf
sub eax, 0xa6ceae7f
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xd6675180
add dword [ebp - 0x58], 0x9e0b17d6
mov dword [ebp - 0x54], 0xbf343bff
sub dword [ebp - 0x54], 0x7dc7da8a
mov dword [ebp - 0x50], 0x90ec19cd
sub dword [ebp - 0x50], 0x2d7cad61
mov dword [ebp - 0x4c], 0x1f008cb0
add dword [ebp - 0x4c], 0xe0ff7350
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3e0c8
push 0
call eax
mov ecx, 0xe82504d3
add ecx, 0x17db43e7
mov edx, eax
mov edi, 0x10035a00
add edi, dword [ebp - 0x48]
mov esi, 0x637e125b
sub esi, 0x45d6fc9
xor dword [ebp - 0x44], 0x3bea4555
mov ebx, dword [edi]
add dword [ebp - 0x20], 0x9f8a0e53
xor ebx, esi
xor dword [ebp - 0x14], 0x70869b56
mov dword [edx], ebx
xor dword [ebp - 4], eax
add edx, 0x5c8b6cd0
sub edx, 0x5c8b6ccc
add edi, 0x4817faff
add edi, 0xb7e80505
loop 0x1000ef06
add eax, 0x88f513b
sub eax, 0x88e3b80
mov ebx, eax
add eax, 5
mov ecx, 0xf628623c
sub ecx, 0xe628623c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Create process on windows
Create process suspended
Create thread
Inject dll
Inject thread

Disassembly:
sub esp, 0x68
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
push 0x44
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00405470
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push str.worldedit.exe
push 0
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [str.NxJS.dll]
mov ecx, dword [0x4092b8]
mov dl, byte [0x4092bc]
push str.Kernel32
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
mov byte [esp + 0x6c], dl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 4
push 0x1000
push 9
mov edi, eax
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [esp + 8]
push 0
push 9
lea ecx, [esp + 0x68]
push ecx
mov esi, eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push esi
push 0x4092cc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
mov eax, dword [esp + 0x18]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 8]
push 0x8000
push 9
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040110a
add esp, 0x68
ret 0x10

Function at 0x40110a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x401114
repz ret
jmp fcn.004012ca
Function at 0x403393
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402278
and dword [ebp - 4], 0
cmp dword [0x40b568], 0
mov ebx, eax
jne 0x403444
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4034f5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4034f5
push eax
call fcn.00402206
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b568], eax
call esi
push eax
call fcn.00402206
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b56c], eax
call esi
push eax
call fcn.00402206
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b570], eax
call esi
push eax
call fcn.00402206
pop ecx
mov dword [0x40b578], eax
test eax, eax
je 0x403444
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402206
pop ecx
mov dword [0x40b574], eax
mov eax, dword [0x40b574]
cmp eax, ebx
je 0x40349c
cmp dword [0x40b578], ebx
je 0x40349c
push eax
call fcn.00402281
push dword [0x40b578]
mov esi, eax
call fcn.00402281
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40349c
test edi, edi
je 0x40349c
call esi
test eax, eax
je 0x403493
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403493
test byte [ebp - 0xc], 1
jne 0x40349c
or dword [ebp + 0x10], 0x200000
jmp 0x4034d5
mov eax, dword [0x40b56c]
cmp eax, ebx
je 0x4034d5
push eax
call fcn.00402281
pop ecx
test eax, eax
je 0x4034d5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4034d5
mov eax, dword [0x40b570]
cmp eax, ebx
je 0x4034d5
push eax
call fcn.00402281
pop ecx
test eax, eax
je 0x4034d5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b568]
call fcn.00402281
pop ecx
test eax, eax
je 0x4034f5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4034f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10034690
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10200c9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102044b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x1003477f
push 0x55
push 0x102044b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10034768
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.1010ca00
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x102044b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10034713
inc edx
cmp edx, 0x55
jl 0x100346f0
mov byte [ebp - 8], 0
push 0x41
call fcn.10142558
mov esi, eax
add esp, 4
test esi, esi
je 0x10034767
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10142558
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x1003475e
push 0x10033e30
push 0x17
mov byte [eax + esi], 0
mov dword [0x102044b0], esi
mov byte [0x102044b4], 1
call fcn.10142558
add esp, 8
jmp 0x10034767
push esi
call fcn.10142558
add esp, 4
pop esi
mov eax, dword [0x102044b0]
mov ecx, 0x1016b5e8
test eax, eax
cmovne ecx, eax
mov dword [0x102044b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
ret
Function at 0x100a94f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b43
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], vtable.icu_69::UnicodeMatcher.0
mov esi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_69::UnicodeSet.0
mov dword [edi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push dword [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.10142558
test al, al
je 0x100a96f1
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
shl eax, 2
push eax
push dword [esi + 8]
push dword [edi + 8]
call fcn.1010cb60
mov eax, dword [esi + 0x2c]
add esp, 0xc
test eax, eax
je 0x100a9698
cmp dword [eax + 4], 0
je 0x100a9698
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10142558
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100a95f8
lea ecx, [ebp - 0x10]
push ecx
push 1
push sym.icuuc69.dll_uhash_compareUnicodeString_69
push sym.icuuc69.dll_uprv_deleteUObject_69
mov ecx, eax
call fcn.10142558
mov ebx, eax
jmp 0x100a95fa
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [edi + 0x2c], ebx
test ebx, ebx
jne 0x100a960e
mov dword [ebp - 0x10], 7
jmp 0x100a9648
cmp dword [ebp - 0x10], 0
jle 0x100a962f
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1015d234]
mov ecx, ebx
call esi
mov dword [edi + 0x2c], 0
jmp 0x100a9648
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push 0x100aae10
push dword [esi + 0x2c]
call fcn.10142558
cmp dword [ebp - 0x10], 0
jle 0x100a9698
cmp dword [edi + 0x18], 0
jne 0x100a9692
cmp dword [edi + 0x30], 0
jne 0x100a9692
mov eax, dword [edi + 8]
mov dword [eax], 0x110000
mov eax, dword [edi + 0x24]
mov dword [edi + 0x10], 1
test eax, eax
je 0x100a9682
push eax
call fcn.10142558
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100a968e
call sym.icuuc69.dll_public:_void___thiscall_icu_69::UVector::removeAllElements_void_
mov byte [edi + 0x14], 0
mov byte [edi + 0x14], 1
jmp 0x100a96f1
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x100a96f1
mov eax, dword [edi + 0x24]
mov esi, dword [esi + 0x28]
test eax, eax
je 0x100a96c0
push eax
call fcn.10142558
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [esi*2 + 2]
push eax
call fcn.10142558
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
je 0x100a96f1
push esi
push ebx
push eax
mov dword [edi + 0x28], esi
call fcn.10142558
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov eax, dword [edi + 0x24]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a9710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10142558
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a97c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.10142558
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100ad890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x18]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0x10]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10142558
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100ad950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0xc]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10142558
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100ae130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159098
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10142558
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10142558
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10142567
pop dword [ebp - 0x4c]
mov eax, 0x38289e0e
add eax, 0xd7eb8759
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x8d655
push 0
mov eax, 0xc1da89d
sub eax, 0xfc07d759
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x95f95ac2
sub ecx, 0x95f90a9f
mov edi, eax
mov esi, 0xe1ea2158
add esi, 0x2e373aa8
add esi, dword [ebp - 0x4c]
mov ebx, 0xb5d6c93f
add ebx, 0x353988dd
sub dword [ebp - 0x2c], 0x57856ab2
mov edx, dword [esi]
mov dword [ebp - 0x28], 0x49a8c68c
xor edx, ebx
add dword [ebp - 0x2c], 0x72df21b5
mov dword [edi], edx
add dword [ebp - 0x48], 0x17c01df3
add edi, 0xe6eb5f22
sub edi, 0xe6eb5f1e
add esi, 0x1267f0e2
sub esi, 0x1267f0de
loop 0x101425c6
add eax, 0x6cb38a2c
add eax, 0x934da933
mov ebx, eax
add eax, 5
mov ecx, 0xf6cebc69
sub ecx, 0xe6cebc69
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.MSVCR100.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x40104d
mov edi, dword [sym.imp.MSVCR100.dll_printf]
push str.Windows_original_main_args:_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
xor esi, esi
pop ecx
cmp dword [eax], ebx
jle 0x40104d
mov eax, dword [sym.imp.MSVCR100.dll___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
add esp, 0xc
inc esi
cmp esi, dword [eax]
jl 0x40102e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
xor ecx, ecx
cmp edi, ebx
jle 0x401087
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x40107c
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov ecx, eax
cmp eax, ebx
jne 0x401097
mov ecx, dword [esi]
mov eax, dword [str.java]
cmp eax, ebx
jne 0x4010a2
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x402194
push 0x402184
push 0x403018
push 2
push 0x403010
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x44a210
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x859c40
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x14
push 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test edi, edi
je 0x44a280
mov edx, dword [0x659a70]
push 0x659788
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalDDiskDoctor
push 0
lea eax, [esp + 0x18]
push 1
push eax
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
mov dword [0x659a6c], eax
pop esi
add esp, 0x14
ret

Function at 0x49aa27
Capabilities:
Encode data using xor

Disassembly:
xchg dword [edi + 0x6a], ecx
dec esi
xor al, byte [0x3e461c49]
pop ebx
invalid

Function at 0x5216f9
Capabilities:
Encode data using xor

Disassembly:
inc edi
dec eax
mov bh, 0x1e
inc esi
loopne 0x521747
jbe 0x5216cf
fild word [esi - 0xc]
shr byte [0xff58eaad], cl
test dword [ecx - 0x7c], edi
outsb dx, byte [esi]
push ecx
dec esp
push esi
sti
int 0x4c
test al, 0xbf
ja 0x5216b2
into
mov ebp, 0xbda9f0f8
in eax, 0xce
mov cl, 0xc6
xor ebx, esp
sbb eax, 0x56d55321
imul dl
test al, 0x1a
fld dword [0xbfe877e9]
sar byte [edi + 0x7256ec61], 1
test esp, 0xe0e614b9
rcl dword [ecx + eax*2 - 0x3c], cl
sahf
retf 0x7ed6
mov dh, 0x5e
mov eax, 0xe6b5446f
stosb byte es:[edi], al
repne lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
sub al, 0xf4
dec edi
inc eax
inc edx
xor ah, bh
dec ebp
lea ebp, [eax - 8]
sbb dword [eax + 0x61968338], esp
pushal
sbb eax, 0x16ca1e83
pop ebx
sbb al, 0x1d
cmp eax, 0x498049c9
inc edi
lodsd eax, dword [esi]
push eax
xchg byte [edx + 0x35], ah
xchg ch, bh
inc eax
mov word [eax], ss
jbe 0x521751
hlt
push ds
retf 0x5b16
popal
pop eax
mov ebp, 0xcc589253
dec eax
or al, 0x94
xor ebp, eax
test al, 0x49
loopne 0x5217c4
lds ebp, [eax + 0x35e06449]
sub byte [eax + 0x7da6962e], bh
inc eax
and esi, edx
push es
dec ebx
fnstsw word [ecx + 0x3b5be339]
and edx, ecx
js 0x5217d0
loop 0x521753
invalid
pop dx
ficomp word [esi]
push ds
stc
loop 0x521789
sub dh, dh
imul edi, dword [ebx - 0x21], 0xaf0feaa3
scasd eax, dword es:[edi]
sub dword [edi + 0x46], ecx
js 0x5217c1
push es
ja 0x521766
rcr cl, 0x9c
invalid

Function at 0x52f478
Capabilities:
Encode data using xor

Disassembly:
mov dword [edx - 0x7cabb42b], esp
push ss
add byte [edi - 0x73], al
push esi
cli
dec esp
mov ebx, 0xa3fcb9fe
invalid

Function at 0x59c837
Capabilities:
Encode data using xor

Disassembly:
retf 0xaa8f
sbb dword [esi + 0x1e7ce874], eax
push eax
jg 0x59c891
movsd dword es:[edi], dword [esi]
xor byte [ecx + 0x40], al
popfd
cmp al, 0x5f
loopne 0x59c808
invalid
invalid