joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4e
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x403e5a
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff413e9e
cmp ebx, 0x40
jle 0x403e71
add dh, al
mov edx, dword [ebp - 4]
call 0x1404196
call fcn.0040d92e
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x403e3f
add bl, bl
jle 0x403ef2
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x7740728a
add byte [ebp - 4], al
call fcn.00406f2e
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call 0x3f3fa6
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x403f2d
add byte [eax], al
jmp 0x403eff
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call fcn.00413f82
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.00404306
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid
Function at 0x44eb3e
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x44eb4a
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff45eb8e
cmp ebx, 0x40
jle 0x44eb61
add dh, al
mov edx, dword [ebp - 4]
call 0x144ee86
call fcn.0045861e
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x44eb2f
add bl, bl
jle 0x44ebe2
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x77451f7a
add byte [ebp - 4], al
call fcn.00451c1e
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0043ec96
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x44ec1d
add byte [eax], al
jmp 0x44ebef
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call fcn.0045ec72
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.0044eff6
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid
Function at 0x4996de
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x4996ea
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff4a972e
cmp ebx, 0x40
jle 0x499701
add dh, al
mov edx, dword [ebp - 4]
call 0x1499a26
call fcn.004a31be
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4996cf
add bl, bl
jle 0x499782
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x7749cb1a
add byte [ebp - 4], al
call fcn.0049c7be
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.00489836
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x4997bd
add byte [eax], al
jmp 0x49978f
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call fcn.004a9812
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.00499b96
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid
Function at 0x4e433e
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x4e434a
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff4f438e
cmp ebx, 0x40
jle 0x4e4361
add dh, al
mov edx, dword [ebp - 4]
call 0x14e4686
call fcn.004ede1e
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4e432f
add bl, bl
jle 0x4e43e2
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x774e777a
add byte [ebp - 4], al
call fcn.004e741e
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call int.004d4496
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x4e441d
add byte [eax], al
jmp 0x4e43ef
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call int.004f4472
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.004e47f6
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid

Function at 0x52b5d2
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
push ds
inc ecx
popal
mov dl, 0x10
cmc
add al, 0xb4
mov ah, 0xf3
sub eax, 0x7a77b707
Function at 0x52f2ae
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x52f2ba
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff53f2fe
cmp ebx, 0x40
jle 0x52f2d1
add dh, al
mov edx, dword [ebp - 4]
call 0x152f5f6
call fcn.00538d8e
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x52f29f
add bl, bl
jle 0x52f352
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x775326ea
add byte [ebp - 4], al
call fcn.0053238e
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0051f406
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x52f38d
add byte [eax], al
jmp 0x52f35f
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call fcn.0053f3e2
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.0052f766
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid
Function at 0x57a0be
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x57a0ca
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff58a10e
cmp ebx, 0x40
jle 0x57a0e1
add dh, al
mov edx, dword [ebp - 4]
call 0x157a406
call fcn.00583b9e
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x57a0af
add bl, bl
jle 0x57a162
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x7757d4fa
add byte [ebp - 4], al
call fcn.0057d19e
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0056a216
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x57a19d
add byte [eax], al
jmp 0x57a16f
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call fcn.0058a1f2
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.0057a576
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid
Function at 0x5c4cde
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x5c4cea
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff5d4d2e
cmp ebx, 0x40
jle 0x5c4d01
add dh, al
mov edx, dword [ebp - 4]
call 0x15c5026
call fcn.005ce7be
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x5c4ccf
add bl, bl
jle 0x5c4d82
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x775c811a
add byte [ebp - 4], al
call fcn.005c7dbe
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005b4e36
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x5c4dbd
add byte [eax], al
jmp 0x5c4d8f
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call fcn.005d4e12
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.005c5196
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid
Function at 0x60fb6e
Capabilities:
Encode data using xor

Disassembly:
call [ecx]
add dword [esi - 0x3d], ebx
add dword [eax + 0xc], ecx
or byte [eax], al
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
js 0x60fb7a
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
push ds
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
add byte [ecx], al
leave
mov edx, 0x6000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
or eax, 0x40ba00
add byte [eax], al
call 0xff61fbbe
cmp ebx, 0x40
jle 0x60fb91
add dh, al
mov edx, dword [ebp - 4]
call 0x160feb6
call fcn.0061964e
insb byte es:[edi], dx
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x60fb5f
add bl, bl
jle 0x60fc12
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x77612faa
add byte [ebp - 4], al
call fcn.00612c4e
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005ffcc6
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
cmp eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add al, byte fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
cmc
add cl, ch
ja 0x60fc4d
add byte [eax], al
jmp 0x60fc1f
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
and eax, dword [eax]
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0x2f
lea eax, [ebp - 4]
call int.0061fca2
mov eax, dword [ebp + 8]
mov esi, dword [ebx - 0x3aa7500]
call fcn.00610026
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
push ebx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x4d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
sub eax, 0xe8fc4500
invalid
Function at 0x658e0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f398
cmp edx, dword [eax]
je 0x658e2f
add eax, 8
inc ecx
cmp eax, 0x65f428
jl 0x658e20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f398]
jne 0x658f5d
mov eax, dword [0xa5bdf4]
cmp eax, 1
je 0x658f37
test eax, eax
jne 0x658e60
cmp dword [0x65f2c4], 1
je 0x658f37
cmp edx, 0xfc
je 0x658f5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658e97
lea eax, [ebp - 0x1a4]
push 0x65e4e8
push eax
call fcn.006597f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00659c80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x658eda
lea eax, [ebp - 0x1a4]
push eax
call fcn.00659c80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e4e4
push edi
call fcn.0065bb50
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e4c8
push eax
call fcn.006597f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00659800
lea eax, [ebp - 0xa0]
push 0x65e4c4
push eax
call fcn.00659800
push dword [esi + 0x65f39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00659800
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e49c
push eax
call fcn.0065bac4
add esp, 0x2c
pop edi
jmp 0x658f5d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f39c]
push 0
push eax
push dword [esi]
call fcn.00659c80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x404430
Capabilities:
Read .ini file

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4044b6
mov ebx, dword [esp + 0x10]
cmp ebx, 0x400
jl 0x4044b6
mov eax, dword [esp + 0x14]
push esi
movzx esi, ax
test esi, esi
je 0x404463
jle 0x4044a7
cmp esi, 2
jg 0x4044a7
push eax
call fcn.0040252e
test eax, eax
je 0x4044a7
push str.ODBC.INI
dec ebx
push ebx
push edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test esi, esi
mov edi, eax
jle 0x404489
cmp esi, 2
jg 0x404489
push 0
call fcn.0040252e
cmp edi, 1
jge 0x4044ad
push 0x6b
push str..MYODBCUtilGetDataSourceNames.c
push str.__s___d__INFO__Call_returned_no_data._Could_be_an_error_or_just_no_data_to_return._n
push 0x41ab98
call fcn.004046a4
add esp, 0x10
pop esi
pop edi
xor eax, eax
pop ebx
ret
pop esi
pop edi
mov eax, 1
pop ebx
ret
push 0x3c
push str..MYODBCUtilGetDataSourceNames.c
push str.__s___d__ERROR__Insufficient_buffer_size._Please_provide_1k_or_better_yet___32k._n
push 0x41ab98
call fcn.004046a4
add esp, 0x10
pop edi
xor eax, eax
pop ebx
ret

Function at 0x404cd7
Capabilities:
Terminate process

Disassembly:
push 8
push 0x416dd0
call fcn.00405de8
push 8
call fcn.00406601
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x41bafc], esi
jne 0x404d0b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x41baf8], esi
mov al, byte [ebp + 0x10]
mov byte [0x41baf4], al
cmp dword [ebp + 0xc], edi
jne 0x404d55
cmp dword [0x425a20], edi
je 0x404d45
mov eax, dword [0x425a1c]
sub eax, 4
mov dword [0x425a1c], eax
cmp eax, dword [0x425a20]
jb 0x404d45
mov eax, dword [eax]
cmp eax, edi
je 0x404d26
call eax
jmp 0x404d26
push 0x41a82c
mov eax, 0x41a624
call fcn.00404c37
pop ecx
push 0x41aa34
mov eax, 0x41a930
call fcn.00404c37
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x404d86
cmp dword [ebp + 0x10], edi
jne 0x404d94
mov dword [0x41bafc], esi
push dword [ebp + 8]
call fcn.00404bf5
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x404d93
push 8
call fcn.00406534
pop ecx
ret
call fcn.00405e23
ret
Function at 0x408a4e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x41add8]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x41b130]
je 0x408a83
inc eax
cmp eax, 0x13
jb 0x408a74
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x41b130]
jne 0x408ba9
mov eax, dword [0x41bb08]
cmp eax, 1
je 0x408b81
cmp eax, edx
jne 0x408ab3
cmp dword [0x41ade0], 1
je 0x408b81
cmp ecx, 0xfc
je 0x408ba9
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408ae9
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00409d20
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00409200
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x408b1d
mov eax, edi
push eax
call fcn.00409200
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x416ef4
push edi
call fcn.00405040
add esp, 0x10
push edi
call fcn.00409200
push dword [esi + 0x41b134]
mov ebx, eax
call fcn.00409200
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00405170
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00409d20
push edi
push ebx
call fcn.00409d30
push 0x416ef0
push ebx
call fcn.00409d30
push dword [esi + 0x41b134]
push ebx
call fcn.00409d30
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00409c27
add esp, 0x2c
jmp 0x408ba9
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x41b134]
push dword [esi]
call fcn.00409200
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040489a
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret