joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456ece
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x483eb0], ebx
push esi
push edi
jne 0x456f4e
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x456f89
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x468ab4
push edi
call esi
test eax, eax
mov dword [0x483eb0], eax
je 0x456f89
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x483eb4], eax
call esi
cmp dword [0x483b00], 2
mov dword [0x483eb8], eax
jne 0x456f4e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x483ec0], eax
je 0x456f4e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x483ebc], eax
mov eax, dword [0x483ebc]
test eax, eax
je 0x456f93
call eax
test eax, eax
je 0x456f7a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x483ec0]
test eax, eax
je 0x456f7a
test byte [ebp - 8], 1
jne 0x456f93
cmp dword [0x483b0c], 4
jb 0x456f8d
or byte [ebp + 0x12], 0x20
jmp 0x456fb2
xor eax, eax
jmp 0x456fc2
or byte [ebp + 0x12], 4
jmp 0x456fb2
mov eax, dword [0x483eb4]
test eax, eax
je 0x456fb2
call eax
mov ebx, eax
test ebx, ebx
je 0x456fb2
mov eax, dword [0x483eb8]
test eax, eax
je 0x456fb2
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x483eb0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4589e9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x458bbd
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x485920]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x458bbd
test cl, 0x48
je 0x458a54
cmp byte [eax + 5], 0xa
je 0x458a54
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x458aa6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x458a8e
call fcn.0044eddd
mov dword [eax], 9
call fcn.0044ede6
mov dword [eax], esi
jmp 0x458a9e
cmp eax, 0x6d
je 0x458bbd
push eax
call fcn.0044edef
pop ecx
or eax, 0xffffffff
jmp 0x458bbf
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x458bb8
test eax, eax
je 0x458acd
cmp byte [ebx], 0xa
jne 0x458acd
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x458ad6
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x458bb2
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x458ba2
cmp al, 0xd
je 0x458b08
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x458b94
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x458b22
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x458b1d
add dword [ebp + 0x10], 2
jmp 0x458b76
mov dword [ebp + 0x10], eax
jmp 0x458b90
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x458b4a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x458b90
cmp dword [ebp - 0xc], 0
je 0x458b90
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x458b6b
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x458b76
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x458b93
cmp ebx, dword [ebp + 0xc]
jne 0x458b7b
cmp byte [ebp - 1], 0xa
jne 0x458b7b
mov byte [ebx], 0xa
jmp 0x458b93
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00456286
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x458b94
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x458aec
jmp 0x458bb2
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x458bb2
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x458bbf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4595f5
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x468c08
call fcn.0044d108
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x483f88], edi
jne 0x459639
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x459624
mov dword [0x483f88], ebx
jmp 0x459639
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x459639
mov dword [0x483f88], 2
mov eax, dword [0x483f88]
cmp eax, ebx
jne 0x459659
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
jmp 0x45971c
cmp eax, 2
je 0x459662
cmp eax, edi
jne 0x45968a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x459675
mov eax, dword [0x483e10]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x459691
xor eax, eax
jmp 0x45971c
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0044eda0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x4596c4
cmp esi, edi
jne 0x4596da
push dword [ebp - 0x20]
call fcn.00448b69
pop ecx
mov esi, eax
cmp esi, edi
je 0x45968a
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
test eax, eax
je 0x45970d
cmp dword [ebp + 0x14], edi
jne 0x4596f7
push edi
push edi
jmp 0x4596fd
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x459719
push esi
call fcn.00448b7b
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0044d143
ret
Function at 0x459725
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x468c18
call fcn.0044d108
xor esi, esi
cmp dword [0x483f8c], esi
jne 0x459769
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x459754
mov dword [0x483f8c], edi
jmp 0x459769
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x459769
mov dword [0x483f8c], 2
mov eax, dword [0x483f8c]
cmp eax, 2
je 0x45984a
cmp eax, esi
je 0x45984a
cmp eax, 1
jne 0x4597ae
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x459797
mov eax, dword [0x483e10]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4597b5
xor eax, eax
jmp 0x45985c
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0044eda0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4597eb
cmp edi, esi
jne 0x459806
lea eax, [ebx + ebx]
push eax
call fcn.00448b69
pop ecx
mov edi, eax
cmp edi, esi
je 0x4597ae
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x459839
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x459823
push esi
push esi
jmp 0x459829
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x459845
push edi
call fcn.00448b7b
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x45985c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0044d143
ret
Function at 0x45a2eb
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x45a304
or eax, 0xffffffff
jmp 0x45a365
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x45a361
push 0x3d
push esi
call fcn.0045a4c0
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x45a361
cmp esi, eax
je 0x45a361
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x483b20]
sete cl
cmp eax, dword [0x483b24]
mov dword [ebp - 8], ecx
jne 0x45a347
mov edi, eax
call fcn.0045a28a
mov dword [0x483b20], eax
cmp eax, ebx
jne 0x45a3a0
cmp dword [ebp + 0xc], ebx
je 0x45a369
cmp dword [0x483b28], ebx
je 0x45a369
call fcn.00459cc4
test eax, eax
je 0x45a3a0
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x45a372
xor eax, eax
jmp 0x45a364
push 4
call fcn.00448b69
cmp eax, ebx
pop ecx
mov dword [0x483b20], eax
je 0x45a361
mov dword [eax], ebx
cmp dword [0x483b28], ebx
jne 0x45a3a0
push 4
call fcn.00448b69
cmp eax, ebx
pop ecx
mov dword [0x483b28], eax
je 0x45a361
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x483b20]
call fcn.0045a23d
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x45a401
cmp dword [esi], ebx
je 0x45a401
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00448b7b
cmp dword [ebp - 8], ebx
pop ecx
jne 0x45a3e4
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x45a442
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x45a3db
mov eax, edi
shl eax, 2
push eax
push dword [0x483b20]
call fcn.0044ccfd
cmp eax, ebx
pop ecx
pop ecx
je 0x45a442
jmp 0x45a43d
cmp dword [ebp - 8], ebx
jne 0x45a4ad
cmp edi, ebx
jge 0x45a410
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x483b20]
call fcn.0044ccfd
cmp eax, ebx
pop ecx
pop ecx
je 0x45a361
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x483b20], eax
cmp dword [ebp + 0xc], ebx
je 0x45a497
push dword [ebp - 4]
call fcn.00449290
inc eax
inc eax
push eax
call fcn.00448b69
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x45a497
push dword [ebp - 4]
push esi
call fcn.0044a350
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
test eax, eax
jne 0x45a490
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00448b7b
pop ecx
cmp dword [ebp - 8], ebx
je 0x45a4a5
push dword [ebp - 4]
call fcn.00448b7b
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x45a364
push dword [ebp - 4]
call fcn.00448b7b
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x45a36e
Function at 0x40b2c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
cmp ebx, 8
push edi
mov esi, ecx
jae 0x40b33e
mov eax, dword [esi]
mov dword [esp + 0x10], 0
shr eax, 2
and eax, 0x1ff
mov edi, 1
mov ecx, dword [eax*4 + 0x422908]
mov dword [esp + 0x18], ecx
mov ecx, 3
mov eax, dword [esp + 0x1c]
dec ecx
mov edx, ebx
shr edx, cl
lea eax, [edi + eax*8 + 1]
mov eax, dword [esi + eax*4]
and edx, 1
mov ebp, edx
sub eax, edx
neg ebp
xor eax, ebp
mov ebp, dword [esp + 0x10]
shr eax, 2
and eax, 0x1ff
lea edi, [edx + edi*2]
add ebp, dword [eax*4 + 0x422908]
test ecx, ecx
mov dword [esp + 0x10], ebp
ja 0x40b2f7
mov eax, dword [esp + 0x18]
pop edi
add eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esi]
sub ebx, 8
dec ecx
not ecx
shr ecx, 2
and ecx, 0x1ff
cmp ebx, 8
mov eax, dword [ecx*4 + 0x422908]
jae 0x40b3d3
mov edx, dword [esi + 0x204]
mov dword [esp + 0x10], 0
shr edx, 2
and edx, 0x1ff
mov edi, 1
mov ecx, dword [edx*4 + 0x422908]
add eax, ecx
mov ecx, 3
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
dec ecx
mov edx, ebx
shr edx, cl
lea eax, [edi + eax*8 + 0x82]
mov eax, dword [esi + eax*4]
and edx, 1
mov ebp, edx
sub eax, edx
neg ebp
xor eax, ebp
mov ebp, dword [esp + 0x10]
shr eax, 2
and eax, 0x1ff
lea edi, [edx + edi*2]
add ebp, dword [eax*4 + 0x422908]
test ecx, ecx
mov dword [esp + 0x10], ebp
ja 0x40b389
mov eax, dword [esp + 0x18]
pop edi
add eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esi + 0x204]
xor ebp, ebp
dec ecx
mov edi, 1
not ecx
shr ecx, 2
and ecx, 0x1ff
mov edx, dword [ecx*4 + 0x422908]
mov ecx, 8
add eax, edx
add ebx, 0xfffffff8
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x1c]
dec ecx
mov eax, dword [esi + edi*4 + 0x408]
shr edx, cl
and edx, 1
mov ebx, edx
sub eax, edx
neg ebx
xor eax, ebx
lea edi, [edx + edi*2]
shr eax, 2
and eax, 0x1ff
add ebp, dword [eax*4 + 0x422908]
test ecx, ecx
ja 0x40b405
mov eax, dword [esp + 0x18]
pop edi
add eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x40efa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebp, 0xa1c6
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
xor edx, edx
cmp edx, dword [edi + 0x33670]
jae 0x40f09e
mov dword [esp + 0x14], 0
mov esi, 1
mov ecx, 6
dec ecx
mov eax, edx
shr eax, cl
add ebp, esi
mov ebp, dword [edi + ebp*4]
and eax, 1
mov ebx, eax
sub ebp, eax
neg ebx
xor ebp, ebx
mov ebx, dword [esp + 0x14]
shr ebp, 2
and ebp, 0x1ff
lea esi, [eax + esi*2]
add ebx, dword [ebp*4 + 0x422908]
mov ebp, dword [esp + 0x10]
test ecx, ecx
mov dword [esp + 0x14], ebx
ja 0x40efd2
lea eax, [edx + ebp]
inc edx
cmp edx, 0xe
mov dword [edi + eax*4 + 0xa314], ebx
jb 0x40efb4
cmp edx, dword [edi + 0x33670]
jae 0x40f09e
mov dword [esp + 0x14], 0
mov esi, 1
mov ecx, 6
jmp 0x40f03a
mov ebp, dword [esp + 0x10]
dec ecx
mov eax, edx
shr eax, cl
add ebp, esi
mov ebp, dword [edi + ebp*4]
and eax, 1
mov ebx, eax
sub ebp, eax
neg ebx
xor ebp, ebx
mov ebx, dword [esp + 0x14]
shr ebp, 2
and ebp, 0x1ff
lea esi, [eax + esi*2]
add ebx, dword [ebp*4 + 0x422908]
test ecx, ecx
mov dword [esp + 0x14], ebx
ja 0x40f036
mov ebp, dword [esp + 0x10]
mov ecx, edx
and ecx, 0x7fffffe
add ecx, 0x7fffff6
lea eax, [edx + ebp - 0xa1c6]
shl ecx, 5
add ecx, ebx
inc edx
mov dword [edi + eax*4 + 0x32a2c], ecx
mov eax, dword [edi + 0x33670]
cmp edx, eax
jb 0x40f022
add ebp, 0x40
cmp ebp, 0xa2c6
mov dword [esp + 0x10], ebp
jb 0x40efb2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40f0c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
lea eax, [ecx + 0x32a2c]
lea edx, [ecx + 0x32e2c]
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xca8b
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jmp 0x40f0f5
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, 4
mov eax, edi
mov dword [esp + 0x2c], eax
mov ebx, dword [edx]
add edx, 4
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x40f108
mov edx, dword [esp + 0x20]
lea ecx, [ecx + edx*4 + 0x32e3c]
mov dword [esp + 0x30], ecx
cmp eax, 0x400
jae 0x40f135
xor ebx, ebx
mov bl, byte [eax + 0x422504]
jmp 0x40f15e
cmp eax, 0x80000
jae 0x40f14e
mov edx, eax
xor ebx, ebx
shr edx, 9
mov bl, byte [edx + 0x422504]
add ebx, 0x12
jmp 0x40f15e
mov ecx, eax
xor ebx, ebx
shr ecx, 0x12
mov bl, byte [ecx + 0x422504]
add ebx, 0x24
mov ecx, ebx
mov edx, ebx
shr ecx, 1
and edx, 1
dec ecx
or edx, 2
mov esi, eax
shl edx, cl
xor ebp, ebp
mov edi, 1
mov dword [esp + 0x24], ebp
sub esi, edx
test ecx, ecx
jbe 0x40f1cf
mov dword [esp + 0x28], ecx
mov ebp, dword [esp + 0x10]
mov ecx, edi
sub ecx, ebx
mov eax, esi
add ecx, edx
and eax, 1
add edi, edi
mov ecx, dword [ebp + ecx*4 + 0x28b14]
mov ebp, eax
sub ecx, eax
or edi, eax
neg ebp
mov eax, dword [esp + 0x28]
xor ecx, ebp
mov ebp, dword [esp + 0x24]
shr ecx, 2
and ecx, 0x1ff
shr esi, 1
add ebp, dword [ecx*4 + 0x422908]
dec eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebp
jne 0x40f184
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
add edx, ebx
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x30]
add edx, ebp
inc eax
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
jb 0x40f124
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
add eax, 0x40
add ebx, 0x200
add edi, 0x100
add edx, 0x80
cmp eax, 0xcb8b
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
jb 0x40f0f1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret

Function at 0x40f250
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
xor edi, edi
add ecx, 0x3362c
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
xor esi, esi
mov edx, 1
mov ebx, 4
mov ecx, dword [esp + 0x18]
mov eax, edi
and eax, 1
mov ecx, dword [ecx + edx*4 + 0x28ce0]
mov ebp, eax
sub ecx, eax
add edx, edx
neg ebp
xor ecx, ebp
or edx, eax
shr ecx, 2
and ecx, 0x1ff
shr edi, 1
mov ebp, dword [ecx*4 + 0x422908]
add esi, ebp
dec ebx
jne 0x40f277
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc edi
mov dword [eax], esi
add eax, 4
cmp edi, 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
jb 0x40f26b
mov edx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [edx + 0x3366c], 0x10
pop ebx
add esp, 0xc
ret
Function at 0x40f910
Capabilities:
Get file size

Disassembly:
push ecx
mov ecx, dword [ecx + 8]
lea eax, [esp]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f939
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f939
xor al, al
pop esi
pop ecx
ret 4
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.00414e60
mov ecx, eax
xor eax, eax
add ecx, esi
pop esi
adc edx, eax
mov eax, dword [esp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop ecx
ret 4

Function at 0x410ad0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
mov eax, dword [edi]
jbe 0x410b09
push ebx
xor ecx, ecx
mov ebx, eax
mov cl, byte [edx]
and ebx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x42310c]
xor eax, ecx
inc edx
dec esi
jne 0x410ae3
mov dword [edi], eax
pop ebx
pop edi
pop esi
ret 8
mov dword [edi], eax
pop edi
pop esi
ret 8
Function at 0x10005110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov al, byte [0x100329e0]
test al, al
jne 0x100051b8
mov byte [0x100329e0], 1
call sym.LIBMYSQL.dll_my_init
call fcn.10004ad0
mov eax, dword [0x100329e4]
test eax, eax
jne 0x10005187
push 0x1002f660
push str.mysql
mov dword [0x100329e4], 0xcea
call 0x1000ab66
test eax, eax
je 0x10005168
mov ax, word [eax + 8]
push eax
call fcn.1000ab60
and eax, 0xffff
mov dword [0x100329e4], eax
push str.MYSQL_TCP_PORT
call fcn.100115bc
add esp, 4
test eax, eax
je 0x10005187
push eax
call fcn.10010960
add esp, 4
mov dword [0x100329e4], eax
mov eax, dword [0x100329e8]
test eax, eax
jne 0x100051b0
push str.MYSQL_UNIX_PORT
mov dword [0x100329e8], 0x1002f630
call fcn.100115bc
add esp, 4
test eax, eax
je 0x100051b0
mov dword [0x100329e8], eax
push 0
call sym.LIBMYSQL.dll_mysql_debug
ret
jmp sym.LIBMYSQL.dll_my_thread_init

Function at 0x10008d30
Capabilities:
Allocate thread local storage

Disassembly:
mov al, byte [0x10032a05]
test al, al
jne 0x10008dcd
mov byte [0x10032a05], 1
call fcn.100096e0
mov eax, dword [0x10032a08]
test eax, eax
jne 0x10008dc8
call fcn.10008ee0
push str.HOME
call fcn.100115bc
add esp, 4
test eax, eax
mov dword [0x10032a08], eax
je 0x10008d80
push eax
push 0x10032c10
call fcn.10008440
add esp, 8
mov dword [0x10032a08], eax
push str.UMASK
call fcn.100115bc
add esp, 4
test eax, eax
je 0x10008da4
push eax
call fcn.10008dd0
add esp, 4
or eax, 0x180
mov dword [0x1002f7f0], eax
push str.UMASK_DIR
call fcn.100115bc
add esp, 4
test eax, eax
je 0x10008dc8
push eax
call fcn.10008dd0
add esp, 4
or eax, 0x1c0
mov dword [0x1002f7f4], eax
jmp 0x10008ff0
ret
sub esp, 0x190
call fcn.10009050
test al, al
je 0x1000903f
lea eax, [esp]
push eax
push 2
call fcn.1000ab96
test eax, eax
je 0x1000901b
call fcn.1000ab90
lea ecx, [esp]
push ecx
jmp 0x1000902d
cmp word [esp], 2
je 0x10009038
call fcn.1000ab90
lea edx, [esp]
push edx
push 2
call fcn.1000ab96
test eax, eax
jne 0x1000903f
mov byte [0x10032a04], 1
xor al, al
add esp, 0x190
ret
Function at 0x10008ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa04
push 0x100329cc
push 2
mov dword [esp + 0xc], 0x100
mov dword [esp + 0x10], 0x400
call fcn.10011cb7
add esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMySQL
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008fe0
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov esi, 1
call edi
cmp eax, 0x103
je 0x10008fd3
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x51c]
push edx
call fcn.10008ec0
lea eax, [esp + 0x520]
push eax
call fcn.1001a2ca
lea ecx, [esp + 0x524]
push ecx
call fcn.1001b13e
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x118]
push ecx
push 0
push 0
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
mov eax, esi
push ecx
push eax
push edx
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 0x400
inc esi
call edi
cmp eax, 0x103
jne 0x10008f5f
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0xa04
ret

Function at 0x100090e0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x100090f0
mov esi, 1
push esi
call fcn.10010d69
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10009142
call fcn.10011004
mov edi, eax
call fcn.10009840
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x10009126
mov edx, dword [fcn.10009200]
mov dword [fcn.10009200], edx
test al, 0x18
je 0x10009137
push esi
push 0x24
push 5
call fcn.10008890
add esp, 0xc
test edi, edi
je 0x1000915d
push 1
call fcn.10011345
test byte [esp + 0x14], 0x20
je 0x1000915d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret