joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60b490
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x4bd1a7
mov edi, dword [edx]
jmp 0x4bd1a9
mov edi, edx
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x4bd1ca
mov edx, eax
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4bd1b6
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
and eax, esi
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + ecx]
cmp edi, dword [ebx + 4]
jne 0x4bd1e9
mov esi, dword [ebx + 4]
jmp 0x4bd1ef
mov esi, dword [eax + ecx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x4bd20b
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edx
call fcn.00422bf0
test al, al
jne 0x4bd23a
mov edx, dword [ebp + 0xc]
cmp esi, edi
jne 0x4bd1f3
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
push edx
mov edi, dword [eax]
push dword [edi + 4]
push edi
call fcn.004bd6c0
mov ecx, 0xe38e37
mov edx, eax
sub ecx, dword [ebx + 8]
cmp ecx, 1
jae 0x4bd257
push str.list_T__too_long
call fcn.0059dd13
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc dword [ebx + 8]
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4bd291
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4bd2ab
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x4bd2cd
cmp eax, esi
jne 0x4bd2b3
mov dword [ecx], edi
jmp 0x4bd2cd
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4bd2cd
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00499e70
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bd3c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x4bd3db
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4bd3f7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4bd3e6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x4bd42d
cmp dword [ecx], edi
jne 0x4bd425
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x4bd435
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4bd435
cmp dword [ecx], edi
jne 0x4bd438
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.004bc2e0
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bd4a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60b4b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x4bd4e7
mov esi, dword [eax]
jmp 0x4bd4e9
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x4bd505
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4bd4f4
mov eax, dword [ebx + 0x18]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + ecx]
cmp edi, dword [ebx + 4]
jne 0x4bd524
mov esi, dword [ebx + 4]
jmp 0x4bd52a
mov esi, dword [eax + ecx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x4bd547
nop
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.00422bf0
test al, al
jne 0x4bd58e
cmp esi, edi
jne 0x4bd530
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4bd574
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4bd5d1
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x4bd5f3
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.004bc2e0
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x4bd5d9
mov dword [ecx], edi
jmp 0x4bd5f3
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4bd5f3
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004bd320
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4beee0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f9138
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
push 0x83
xor eax, eax
mov dword [ebp - 0x14], 7
push str.DELETE_FROM_NamedObjectsOp_n_________________WHERE_Time____SELECT_MIN_Ps.creationTime__FROM_Ps_WHERE_Ps.creationTime_0___n
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004346a0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0059bd36
push 0x7d
push str.DELETE_FROM_NamedObjects_WHERE_NamedObjects.RID_NOT_IN__n__________________SELECT_ObjName_ID_FROM_NamedObjectsOp___n
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], eax
call fcn.004346a0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0059bd36
push 0x81
push str.DELETE_FROM_CodeInjectOp_n_________________WHERE_Time____SELECT_MIN_Ps.creationTime__FROM_Ps_WHERE_Ps.creationTime_0___n
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.004346a0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0059bd36
push 0x73
push str.DELETE_FROM_CodeInjectOp_WHERE_CodeInjectOp.Module_ID_NOT_IN__n_________________SELECT_RID__FROM_Files__n
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], eax
call fcn.004346a0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0059bd36
push 0x87
push str.DELETE_FROM_MemoryArtifact_n____________________WHERE_Time____SELECT_MIN_Ps.creationTime__FROM_Ps_WHERE_Ps.creationTime_0___n
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.004346a0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0059bd36
push 0x86
push str.DELETE_FROM_CredentialsOp_n____________________WHERE_Time____SELECT_MIN_Ps.creationTime__FROM_Ps_WHERE_Ps.creationTime_0___n
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.004346a0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0059bd36
mov ecx, dword [ebp - 0x2c]
mov esi, eax
call fcn.004c1770
mov ecx, dword [ebp - 0x14]
add esi, eax
add esi, edi
add esi, ebx
add esi, dword [ebp - 0x30]
add esi, dword [ebp - 0x34]
add esi, dword [ebp - 0x38]
cmp ecx, 8
jb 0x4bf00e
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00434bd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b168a
mov esp, ebp
pop ebp
ret
Function at 0x4c0050
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
dec edx
mov dword [ebp - 8], 0
mov esi, ecx
mov dword [ebp - 4], esi
cmp edx, 5
ja case.default.0x4c006d
jmp dword [edx*4 + 0x4c025c]
mov eax, dword [ebp + 8]
sub eax, 0
je 0x4c00a5
sub eax, 1
je 0x4c0093
mov eax, 0x651b44
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.ScreenCapturingScretchBlt
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.ScreenCapturingBitBlt
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
mov ecx, 0x651b44
mov eax, str.FindFile
cmovne eax, ecx
mov ecx, esi
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x4c00df
jmp dword [eax*4 + 0x4c0274]
mov eax, str.AsyncKeyState
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.SyncKeyState
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.SyncKeyboardState
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.SetWinHook
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x651b44
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x4c00df
jmp dword [eax*4 + 0x4c0284]
mov eax, str.WindowText
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.Parent
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.WindowLong
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.ForegroundWindow
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x4c00df
jmp dword [eax*4 + 0x4c0294]
mov eax, str.QueryProcesses
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.QueryProcessesEx
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.QueryProcessesFull
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.QueryProcessIdInfo
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
sub eax, 1
je 0x4c0236
sub eax, 1
je 0x4c0224
sub eax, 1
je 0x4c0212
mov eax, 0x651b44
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.Write
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.Read
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, str.Open
push eax
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push str.not_implemented
call fcn.004347d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c1650
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fec58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4c169f
mov eax, dword [esi]
jmp 0x4c16a1
mov eax, esi
xor ecx, ecx
push 2
mov word [eax], cx
mov ecx, esi
push 0x658584
call fcn.004346a0
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push 0xa
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x65856c
mov word [ecx], ax
call fcn.004346a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4c1770
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60bc80
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x7d
xor eax, eax
mov dword [ebp - 0x14], 7
push str.DELETE_FROM_SensorOp_n_________________WHERE_Time____SELECT_MIN_Ps.creationTime__FROM_Ps_WHERE_Ps.creationTime_0___n
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004346a0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0059bd36
mov edi, eax
lea eax, [ebp - 0x58]
push 0xd
push eax
call fcn.0046c890
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push str.DELETE_FROM_ZipContent_WHERE_ZipContent.SensorOp_ID_NOT_IN__n______________SELECT_RID_FROM_SensorOp_______________n_____________WHERE_____________________________________n_____________Sensor_ID_
push eax
call fcn.00438d70
push 0x64e124
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
push eax
call fcn.004238e0
add esp, 0x20
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4c181c
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x4c1849
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov ecx, esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x48], 0
push eax
call fcn.0059bd36
lea esi, [eax + edi]
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x4c1880
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.00434bd0
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
cmp ecx, 8
jb 0x4c18a9
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00434bd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b168a
mov esp, ebp
pop ebp
ret
Function at 0x4c3560
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c1bc
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.00598889
cmp eax, 6
jne 0x4c3757
cmp dword [ebx + 0x1e4], 0
jne 0x4c3757
push 0
lea eax, [ebp - 0x24c]
mov ecx, ebx
push eax
call fcn.00598904
mov edi, eax
push 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.00598904
mov esi, eax
push 1
push 0
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
mov dword [ebp - 0x2d0], 0x5f
call fcn.0041d7f0
push eax
push 0
lea eax, [ebp - 0x264]
mov ecx, esi
push eax
call fcn.0041a980
mov eax, dword [ebp - 0x220]
cmp eax, 8
jb 0x4c3628
inc eax
lea ecx, [ebp - 0x234]
push eax
push dword [ebp - 0x234]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x238]
cmp eax, 8
jb 0x4c3667
inc eax
lea ecx, [ebp - 0x24c]
push eax
push dword [ebp - 0x24c]
call fcn.00434bd0
xor eax, eax
mov dword [ebp - 0x238], 7
cmp dword [ebp - 0x250], 8
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x264]
cmovae eax, dword [ebp - 0x264]
push eax
mov dword [ebp - 0x23c], 0
call fcn.005dc62c
add esp, 4
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4c3739
push 0x104
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x4c3732
lea ecx, [ebp - 0x2cc]
call fcn.0046c330
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x2cc], 3
call fcn.004347d0
push eax
lea ecx, [ebp - 0x2c8]
call fcn.0041aab0
lea ecx, [ebp - 0x27c]
call fcn.00413860
mov ecx, ebx
call fcn.00596c96
lea eax, [ebp - 0x2cc]
mov ecx, ebx
push eax
call fcn.00596c80
lea ecx, [ebp - 0x2cc]
call fcn.004340d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x250]
cmp eax, 8
jb 0x4c3757
inc eax
lea ecx, [ebp - 0x264]
push eax
push dword [ebp - 0x264]
call fcn.00434bd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 4
Function at 0x4c4ef0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, ecx
push str.cpb_init
push dword [esi]
call edi
mov dword [esi + 8], eax
test eax, eax
jne 0x4c4f0f
pop edi
xor al, al
pop esi
ret
push str.cpb_shutdown
push dword [esi]
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x4c4f0a
push str.cpb_flush
push dword [esi]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_start
push dword [esi]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_commit
push dword [esi]
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_cancel
push dword [esi]
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_exempt_process
push dword [esi]
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_add_exempt_rule
push dword [esi]
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_add_extension
push dword [esi]
call edi
mov dword [esi + 0x28], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_set_timeout
push dword [esi]
call edi
mov dword [esi + 0x2c], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_set_max_file_size
push dword [esi]
call edi
mov dword [esi + 0x30], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_set_mbr_protection
push dword [esi]
call edi
mov dword [esi + 0x34], eax
test eax, eax
je 0x4c4f0a
push str.cpb_policy_set_backup_mode
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x38], eax
pop edi
setne al
pop esi
ret

Function at 0x4ca4f0
Capabilities:
Connect pipe

Disassembly:
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x14]
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x4ca52f
push eax
push str.could_not_connect_properly__error__u_
push str.APIManager::Connect
push 1
call fcn.00587c13
add esp, 0x10
mov dword [edi + 0x2030], 0
pop edi
pop esi
ret
cmp eax, 0x217
je 0x4ca559
cmp eax, 0x3e5
je 0x4ca54c
push eax
push str.unknown_error__u
push str.APIManager::Connect
push 4
jmp 0x4ca51a
mov dword [edi + 0x2030], 2
pop edi
pop esi
ret
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [edi + 0x2030], 3
pop edi
pop esi
ret
Function at 0x4ca620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
push 0x2002
push 0
lea esi, [edi + 0x28]
mov dword [edi + 0x202c], 0
push esi
call fcn.005ca820
add esp, 0xc
lea eax, [edi + 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0x2000
push esi
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x4ca68b
mov eax, dword [ebp - 4]
test eax, eax
je 0x4ca6df
mov ecx, edi
mov dword [edi + 0x202c], eax
call fcn.004ca6f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x3e5
je 0x4ca6df
push eax
push str.unknown_error__u
push str.APIManager::ReadData
push 4
call fcn.00587c13
add esp, 0x10
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
jne 0x4ca6cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_disconnect_properly__error__u_
push str.APIManager::Disconnect
push 1
call fcn.00587c13
add esp, 0x10
mov dword [edi + 0x2030], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x2030], 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4da8b0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ea88
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x28]
push 0x64
push eax
call fcn.004dfd00
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push str.SELECT_MIN_CreationTime__FROM_Ps_WHERE_CreationTime___0_AND_Ps_RID__
push eax
call fcn.004de390
add esp, 0x14
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4da918
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433e40
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
lea ecx, [esi + 0x28]
mov dword [ebp - 0x14], 0xf
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x18], 0
push eax
mov byte [ebp - 0x28], 0
call fcn.0059bef8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0059bbbd
test al, al
jne 0x4da984
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.0059c259
test edx, edx
jl 0x4da984
jg 0x4da96a
test eax, eax
je 0x4da984
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.0059c259
mov dword [esi + 0x2e0], eax
mov dword [esi + 0x2e4], edx
lea ecx, [ebp - 0x58]
call fcn.0059b53b
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x4da9a1
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433e40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b168a
mov esp, ebp
pop ebp
ret
Function at 0x4e56c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x4e56db
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4e56f7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4e56e6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x4e572d
cmp dword [ecx], edi
jne 0x4e5725
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x4e5735
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4e5735
cmp dword [ecx], edi
jne 0x4e5738
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.004e5cd0
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8