joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a74e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x80
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebx]
jne 0x100a750c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1018fde0]
test eax, eax
je 0x100a7517
call eax
lea eax, [esi*8]
push eax
call fcn.100bf300
mov ecx, dword [0x1018fde4]
add esp, 4
mov esi, eax
mov dword [ebp - 4], esi
test ecx, ecx
je 0x100a7538
call ecx
test esi, esi
je 0x100a7504
push dword [ebx + 0xc]
call fcn.100885a0
push esi
mov dword [ebx + 0xc], esi
call dword [0x1018b76c]
shr eax, 3
mov dword [ebp + 0xc], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.1011a400
mov ecx, dword [ebx + 8]
add esp, 0x14
mov dword [ebx + 8], 0
test ecx, ecx
je 0x100a761f
push edi
lea esp, [esp]
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x100a75ad
lea esp, [esp]
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x1015a3f8]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x100a7590
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp + 0xc]
mov eax, dword [ebp - 4]
lea esi, [eax + edx*8]
test esi, esi
je 0x100a75f8
mov eax, dword [esi]
test eax, eax
je 0x100a75cb
mov edx, dword [esi + 4]
jmp 0x100a75cd
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x100a75f8
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x100a75ed
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x100a7614
mov eax, dword [ebp + 8]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x100a7614
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x100a760a
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x100a7580
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b3f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100b40f5
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100b3fa3
cmp dword [edi + 0x1f8], 0
jne 0x100b3fb2
mov eax, 0xffff
add word [esi + 0x20], ax
jne 0x100b40f4
push ebx
mov ebx, dword [esi + 0x10]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x100b409f
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x20], eax
test edi, edi
je 0x100b3fd8
cmp dword [edi + 0x1f8], 0
jne 0x100b4079
mov esi, dword [ebx]
mov ecx, esi
mov dword [ebp - 0x18], esi
test esi, esi
je 0x100b3ff6
cmp byte [esi], 0
je 0x100b3fee
inc ecx
cmp byte [ecx], 0
jne 0x100b3fe8
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x24]
add eax, 0x18
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x100b4055
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], esi
test ecx, ecx
jle 0x100b4046
mov edi, ecx
mov ecx, esi
jmp 0x100b4020
movzx eax, byte [ecx]
lea edx, [ebx*8]
dec edi
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x1015a3f8]
xor esi, edx
xor ebx, esi
test edi, edi
jg 0x100b4020
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x18]
mov eax, ebx
xor edx, edx
div dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
jmp 0x100b4057
xor edx, edx
push edx
push ecx
push esi
push eax
mov dword [ebp - 4], edx
call fcn.1009a310
add esp, 0x10
test eax, eax
je 0x100b4079
push dword [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.100a7df0
add esp, 0xc
push dword [ebx + 0x1c]
push edi
call fcn.100b36a0
push ebx
push edi
call fcn.100b36a0
mov eax, dword [ebp - 0x20]
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, eax
test eax, eax
jne 0x100b3fc1
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.100b9bf0
push esi
push edi
call fcn.100da490
push dword [esi]
push edi
call fcn.100b36a0
push dword [esi + 0x28]
push edi
call fcn.100b36a0
mov ebx, dword [esi + 0x1c]
add esp, 0x20
test ebx, ebx
je 0x100b40d9
push ebx
push edi
call fcn.10093550
push ebx
push edi
call fcn.100b36a0
add esp, 0x10
push dword [esi + 0x2c]
push edi
call fcn.100b7710
push esi
push edi
call fcn.100d76c0
push esi
push edi
call fcn.100b36a0
add esp, 0x18
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b8bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
push esi
push edi
test edx, edx
je 0x100b8bdd
cmp byte [edx], al
je 0x100b8bd5
jmp 0x100b8bd0
inc ebx
cmp byte [ebx], al
jne 0x100b8bd0
sub ebx, edx
and ebx, 0x3fffffff
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], edi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], esi
test esi, esi
jle 0x100b8cca
mov esi, dword [ecx + 8]
mov dword [ebp - 0x10], esi
lea esp, [esp]
mov eax, edi
cmp edi, 2
jge 0x100b8c0a
xor eax, 1
shl eax, 4
cmp dword [ebp + 0x10], 0
mov ecx, dword [eax + esi + 0xc]
mov dword [ebp + 8], ecx
je 0x100b8c6b
mov ecx, dword [ebp + 0x10]
mov edx, ecx
mov esi, dword [eax + esi]
mov al, byte [ecx]
test al, al
je 0x100b8c4d
jmp 0x100b8c30
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x1015a3f8]
cmp al, byte [ecx + 0x1015a3f8]
jne 0x100b8c4d
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x100b8c30
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x1015a3f8]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x1015a3f8]
sub eax, ecx
jne 0x100b8cd8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add ecx, 0x18
mov dword [ebp + 8], ecx
cmp dword [ecx + 0xc], 0
je 0x100b8cac
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x100b8ca1
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x1015a3f8]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x100b8c81
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x100b8cae
xor edx, edx
push edx
push ebx
push dword [ebp + 0xc]
push ecx
call fcn.1009a310
add esp, 0x10
test eax, eax
je 0x100b8cd1
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x100b8cdb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x100b8cdb
mov eax, dword [ebp - 4]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0xc]
jge 0x100b8cca
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
jmp 0x100b8c00
Function at 0x100b8cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
mov ebx, edx
push esi
push edi
test edx, edx
je 0x100b8d1d
cmp byte [edx], cl
je 0x100b8d15
jmp 0x100b8d10
inc ebx
cmp byte [ebx], cl
jne 0x100b8d10
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
mov edi, dword [esi + 4]
mov dword [ebp - 0xc], edi
test edi, edi
jle 0x100b8e08
mov edi, eax
cmp eax, 2
jge 0x100b8d3d
xor edi, 1
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100b8d9f
mov edx, eax
mov ecx, edi
mov eax, dword [esi + 8]
add ecx, ecx
mov esi, dword [eax + ecx*8]
mov eax, edx
mov al, byte [eax]
test al, al
je 0x100b8d7d
jmp 0x100b8d60
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x1015a3f8]
cmp al, byte [ecx + 0x1015a3f8]
jne 0x100b8d7d
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x100b8d60
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x1015a3f8]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x1015a3f8]
sub eax, ecx
jne 0x100b8e16
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 4], ecx
cmp dword [ecx + 0xc], 0
je 0x100b8de8
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x100b8de0
mov edi, edi
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x1015a3f8]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x100b8dc0
mov ecx, dword [ebp - 4]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x100b8dea
xor edx, edx
push edx
push ebx
push dword [ebp + 0xc]
push ecx
call fcn.1009a310
add esp, 0x10
test eax, eax
je 0x100b8e0f
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100b8e19
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x100b8e19
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0xc]
jge 0x100b8e06
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jmp 0x100b8d33
Function at 0x100b9eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
mov eax, dword [eax]
push esi
xor esi, esi
test dword [eax + 0xc], 0x4000000
je 0x100b9feb
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [eax + 0x24]
test ebx, ebx
je 0x100b9f06
mov edi, dword [ebx + 0x14]
test edi, edi
jle 0x100b9efc
lea edx, [ebx + 0x24]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x100b9eed
or eax, 0xffffffff
jmp 0x100b9ef4
mov eax, 1
shl eax, cl
or esi, eax
add edx, 8
dec edi
jne 0x100b9ee1
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x100b9ed7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edi, ecx
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x100b9f24
cmp byte [ecx], 0
je 0x100b9f1c
inc edi
cmp byte [edi], 0
jne 0x100b9f16
sub edi, ecx
and edi, 0x3fffffff
mov eax, dword [eax + 0x44]
xor edx, edx
add eax, 0x38
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
cmp dword [eax + 0xc], edx
je 0x100b9f70
mov dword [ebp - 0xc], ecx
mov ebx, edi
test edi, edi
jle 0x100b9f65
mov edi, ecx
movzx eax, byte [edi]
lea edi, [edi + 1]
dec ebx
movzx ecx, byte [eax + 0x1015a3f8]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test ebx, ebx
jg 0x100b9f42
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov eax, edx
xor edx, edx
div dword [ebx]
mov eax, ebx
push edx
push edi
push ecx
push eax
call fcn.1009a310
add esp, 0x10
test eax, eax
je 0x100b9fe2
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x100b9fe2
jmp 0x100b9f90
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1009f9d0
mov edx, dword [ebp - 8]
add esp, 0x14
test edx, edx
je 0x100b9fdb
mov edi, dword [edx + 4]
test edi, edi
jle 0x100b9fdb
mov edx, dword [edx + 8]
lea ecx, [ecx]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x100b9fcc
or eax, 0xffffffff
jmp 0x100b9fd3
mov eax, 1
shl eax, cl
or esi, eax
add edx, 4
dec edi
jne 0x100b9fc0
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x100b9f90
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100da350
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
push 0x10194a60
mov dword [0x10194a60], eax
mov dword [0x10194a64], eax
mov dword [0x10194a68], eax
mov dword [0x10194a6c], eax
mov dword [0x10194a70], eax
mov dword [0x10194a74], eax
mov dword [0x10194a78], eax
mov dword [0x10194a7c], eax
mov dword [0x10194a80], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.100da0a0
test eax, eax
jne 0x100da3ee
push esi
cmp dword [0x1018b74c], eax
jne 0x100da3a0
xor esi, esi
jmp 0x100da3bb
push 2
call dword [0x1018b788]
mov esi, eax
add esp, 4
test esi, esi
je 0x100da3bb
push esi
call dword [0x1018b790]
add esp, 4
push 0x1018b680
call fcn.100dc840
mov eax, dword [0x1018fd2c]
add esp, 4
mov dword [0x1018b68c], eax
mov dword [0x1018fd2c], 0x1018b680
test esi, esi
je 0x100da3ea
push esi
call dword [0x1018b798]
add esp, 4
xor eax, eax
pop esi
ret
xor eax, eax
ret

Function at 0x100da860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jle 0x100da890
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x1015a3f8]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x100da872
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x100dae00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor edx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], edx
mov esi, dword [esi]
mov dword [ebp - 0x14], esi
lea esp, [esp]
mov al, byte [edx + 0x1015a960]
mov byte [ebp - 1], al
test esi, esi
je 0x100daecf
cmp byte [esi], 0
mov ecx, esi
je 0x100dae3e
inc ecx
cmp byte [ecx], 0
jne 0x100dae38
mov eax, dword [ebp + 8]
sub ecx, esi
add eax, 0x19c
and ecx, 0x3fffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
cmp dword [eax + 0xc], 0
je 0x100daea5
xor edi, edi
mov dword [ebp - 0xc], esi
mov ebx, ecx
test ecx, ecx
jle 0x100dae93
mov ecx, esi
jmp 0x100dae70
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x1015a3f8]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x100dae70
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov eax, edi
xor edx, edx
mov edi, dword [ebp + 8]
div dword [edi + 0x19c]
mov eax, dword [ebp - 0x18]
jmp 0x100daeaa
mov edi, dword [ebp + 8]
xor edx, edx
push edx
push ecx
push esi
push eax
call fcn.1009a310
add esp, 0x10
test eax, eax
je 0x100daec5
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
jmp 0x100daed2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov al, byte [ebp - 1]
jmp 0x100daed2
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100daee2
movzx eax, al
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
add ecx, 0xffffffec
cmp dword [ecx + 0xc], 0
jne 0x100daf01
inc edx
mov dword [ebp - 8], edx
cmp edx, 3
jl 0x100dae20
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
pop edi
pop esi
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [edx + 0x10], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e3830
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cc08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0
cmp dword [edi], 0
mov dword [ebp - 4], 0
je 0x100e3960
push 0x36
push str.SELECT_name_FROM_sqlite_master_WHERE_type__AND_name_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10002130
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
push 0
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
inc eax
push eax
push ecx
push dword [edi]
call fcn.10089320
add esp, 0x14
test eax, eax
sete al
test al, al
mov byte [ebp - 0x30], al
sete bl
cmp dword [ebp - 0x14], 0x10
jb 0x100e38de
push dword [ebp - 0x28]
call fcn.1011a1ea
add esp, 4
test bl, bl
jne 0x100e3960
push str.table
lea ecx, [ebp - 0x28]
call fcn.10001c30
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0xffffffffffffffff
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push dword [ebp - 0x2c]
call fcn.10089f40
add esp, 0x14
test eax, eax
jne 0x100e3935
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x100e391c
mov esi, dword [esi]
push 0xffffffffffffffff
push eax
push esi
push 2
push dword [ebp - 0x2c]
call fcn.10089f40
add esp, 0x14
test eax, eax
jne 0x100e3935
xor bl, bl
jmp 0x100e3937
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x100e3948
push dword [ebp - 0x28]
call fcn.1011a1ea
add esp, 4
test bl, bl
jne 0x100e3960
push dword [ebp - 0x2c]
call fcn.1008adc0
add esp, 4
cmp eax, 0x64
jne 0x100e3960
mov bl, 1
jmp 0x100e3962
xor bl, bl
cmp byte [ebp - 0x30], 0
je 0x100e3973
push dword [ebp - 0x2c]
call fcn.1008b740
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 4
Function at 0x100e3d10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cc08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
je 0x100e3e0c
test edi, edi
je 0x100e3e0c
mov dword [ebp - 0x2c], 0
push str.SELECT_value_FROM_meta_WHERE_key_
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.10001c30
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
push 0
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
inc eax
push eax
push ecx
push dword [ebx]
call fcn.10089320
add esp, 0x14
test eax, eax
sete al
test al, al
mov byte [ebp - 0x30], al
sete bl
cmp dword [ebp - 0x14], 0x10
jb 0x100e3dae
push dword [ebp - 0x28]
call fcn.1011a1ea
add esp, 4
test bl, bl
jne 0x100e3df5
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x100e3dbd
mov esi, dword [esi]
push 0xffffffffffffffff
push eax
push esi
push 1
push dword [ebp - 0x2c]
call fcn.10089f40
add esp, 0x14
test eax, eax
jne 0x100e3df5
push dword [ebp - 0x2c]
call fcn.1008adc0
add esp, 4
cmp eax, 0x64
jne 0x100e3df5
push 0
push dword [ebp - 0x2c]
call fcn.1008b470
add esp, 8
mov dword [edi], eax
mov bl, 1
jmp 0x100e3df7
xor bl, bl
cmp byte [ebp - 0x30], 0
je 0x100e3e08
push dword [ebp - 0x2c]
call fcn.1008b740
add esp, 4
mov al, bl
jmp 0x100e3e0e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 8
Function at 0x100e4ca0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push 0
push 0x50
push dword [esi + 0x24]
call fcn.10120339
add esp, 0xc
test eax, eax
jne 0x100e4ce2
push dword [esi + 0x24]
lea eax, [esi + 0x20]
push 1
push 1
push eax
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4ce2
push 0
push 0x51
push dword [esi + 0x24]
call fcn.10120339
add esp, 0xc
test eax, eax
je 0x100e4cea
pop esi
mov eax, 1
pop ebx
ret
push edi
push dword [esi + 0x24]
lea edi, [esi + 0x10]
push 1
push 4
push edi
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
mov eax, dword [edi]
cmp eax, dword [esi + 0x28]
jae 0x100e4e42
cmp eax, 0x50
jbe 0x100e4e42
push dword [esi + 0x24]
lea edi, [esi + 0x18]
push 1
push 4
push edi
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
mov eax, dword [edi]
cmp eax, dword [esi + 0x28]
jae 0x100e4e42
cmp eax, 0x50
jbe 0x100e4e42
push dword [esi + 0x24]
lea edi, [esi + 0x14]
push 1
push 4
push edi
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
mov eax, dword [edi]
cmp eax, dword [esi + 0x28]
jae 0x100e4e42
push dword [esi + 0x24]
lea ebx, [esi + 0x1c]
push 1
push 4
push ebx
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
mov eax, dword [ebx]
cmp eax, dword [esi + 0x28]
jae 0x100e4e42
push 2
push 0xffffffffffffffe8
push dword [esi + 0x24]
call fcn.10120339
add esp, 0xc
test eax, eax
jne 0x100e4e42
push dword [esi + 0x24]
push 1
push 4
push esi
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
push dword [esi + 0x24]
push eax
lea eax, [esi + 8]
push 4
push eax
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
cmp dword [edi], 0
jne 0x100e4dfa
cmp dword [ebx], 0
jne 0x100e4dfa
pop edi
mov dword [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], 0
pop esi
pop ebx
ret
push 2
push 0xffffffffffffffe0
push dword [esi + 0x24]
call fcn.10120339
add esp, 0xc
test eax, eax
jne 0x100e4e42
push dword [esi + 0x24]
lea eax, [esi + 4]
push 1
push 4
push eax
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
push dword [esi + 0x24]
push eax
lea eax, [esi + 0xc]
push 4
push eax
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4e42
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x100e4e50
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cdb1
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 0
push dword [ebx + 0x18]
mov dword [ebp - 4], 1
push dword [ebx + 0x24]
call fcn.10120339
add esp, 0xc
test eax, eax
jne 0x100e4fc5
mov dword [ebp - 0x30], eax
cmp dword [ebx + 8], eax
jbe 0x100e4fc5
push dword [ebx + 0x24]
lea eax, [ebp - 0x2c]
push 1
push 4
push eax
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e4fc5
mov eax, dword [ebp - 0x2c]
test eax, eax
js 0x100e4fc5
add dword [ebx + 0x2c], eax
inc eax
push eax
call fcn.101160b2
mov edi, eax
add esp, 4
test edi, edi
je 0x100e4fc5
mov eax, dword [ebp - 0x2c]
inc eax
push eax
push 0
push edi
call fcn.1011a400
push dword [ebx + 0x24]
push dword [ebp - 0x2c]
push 1
push edi
call fcn.101201fe
mov ecx, dword [ebp - 0x2c]
add esp, 0x1c
cmp eax, ecx
jne 0x100e4fbc
xor esi, esi
test ecx, ecx
jle 0x100e4f72
mov edi, edi
movsx eax, byte [esi + edi]
movsx ecx, byte [ebx + 0x20]
xor ecx, eax
movsx eax, byte [ebp - 0x2c]
xor ecx, eax
push ecx
call fcn.1011c6e6
mov byte [esi + edi], al
add esp, 4
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x100e4f50
cmp byte [edi], 0
jne 0x100e4f7b
xor eax, eax
jmp 0x100e4f89
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100e4f80
sub eax, edx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.10002130
push edi
call fcn.1011bfcc
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
add esp, 4
mov ecx, esi
push eax
call fcn.100e59a0
mov edi, dword [ebp - 0x30]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, dword [ebx + 8]
jb 0x100e4ee5
jmp 0x100e4fc5
push edi
call fcn.1011bfcc
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x100e4fd6
push dword [ebp - 0x28]
call fcn.1011a1ea
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 4