joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409a1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409a55
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404390
jmp 0x409a5e
mov eax, ebx
mov edx, esi
call fcn.004042f4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409a68
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409a8a
movzx eax, byte [esp]
jmp 0x409a8c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a11c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409f94
mov eax, dword [0x413bf0]
cmp byte [eax], 0
je 0x40a198
mov eax, dword [0x413b08]
call fcn.004030a4
call fcn.00402eac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407358
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a1e0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a1ce
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x413ae8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4167f0]
call fcn.004051c0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x410d7c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404510
add esp, 0x104
pop ebx
ret

Function at 0x410dac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046a4
xor eax, eax
push ebp
push 0x410df4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004046b4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410dfb
lea eax, [ebp - 4]
call fcn.004042a0
ret
Function at 0x411074
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x418a90]
mov ecx, 0x40
call fcn.00402f40
mov dword [0x4189dc], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x4189dc
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x4110a2
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x4189dc]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.00410f54
mov esi, eax
mov dword [ebx*4 + 0x4189dc], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.00410f54
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x411112
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x4110c2
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41119c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [0x418a88]
sub dword [ebx + 8], eax
mov eax, dword [0x418a84]
sub dword [ebx], eax
mov esi, 0x14
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 4]
mov dword [ebx + 8], edx
mov edx, dword [ebx]
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00410f54
mov ebp, eax
mov eax, dword [ebx + 4]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00410f54
mov edi, eax
mov eax, dword [ebx + 8]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x4189e0]
mov edx, edi
call fcn.00410f5c
xor eax, ebp
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x4189dc]
mov edx, ebp
call fcn.00410f5c
xor edi, eax
mov dword [ebx], edi
dec esi
test esi, esi
jne 0x4111b6
mov eax, dword [0x4189e0]
sub dword [ebx + 0xc], eax
mov eax, dword [0x4189dc]
sub dword [ebx + 4], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4113cc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046a4
mov eax, dword [ebp - 8]
call fcn.004046a4
xor eax, eax
push ebp
push 0x41146d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x800
call fcn.00402d84
mov esi, eax
push esi
push 0
push 0x41147c
mov eax, dword [ebp - 4]
call fcn.004046b4
push eax
call sub.kernel32.dll_GetTempFileNameA
push esi
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
mov edx, esi
call fcn.00404498
mov eax, esi
call fcn.00402da0
mov edx, dword [ebx]
mov eax, 0x411488
call fcn.004047a4
mov edx, eax
dec edx
mov eax, ebx
call fcn.004048e8
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411474
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042c4
ret
Function at 0x411490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046a4
xor eax, eax
push ebp
push 0x41153a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403108
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004046b4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x411524
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411541
lea eax, [ebp - 4]
call fcn.004042a0
ret
Function at 0x412294
Capabilities:
Delete file
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x41229c
push ebx
push esi
push edi
mov eax, dword [0x413bf0]
mov byte [eax], 1
mov eax, 0x41164c
call fcn.00405a14
xor eax, eax
push ebp
push 0x412446
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x413a88]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
call fcn.00410e04
mov edx, dword [ebp - 0x14]
mov eax, 0x418aa4
call fcn.004042f4
lea edx, [ebp - 0x18]
mov eax, dword [0x418aa4]
call fcn.00410d18
mov edx, dword [ebp - 0x18]
mov eax, 0x418aa4
call fcn.004042f4
mov bl, 1
xor eax, eax
push ebp
push 0x4123a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f5a4]
call fcn.004036d4
mov esi, eax
mov edx, esi
mov eax, 0x412460
call fcn.00411548
mov edx, 0x418a98
mov ecx, 0xc
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
call fcn.0041066c
mov edx, esi
mov eax, 0x41246c
call fcn.00411548
lea eax, [ebp - 0x20]
mov edx, 0x418a98
call fcn.00404504
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov eax, dword [0x418aa4]
call fcn.004113cc
mov edx, dword [ebp - 0x1c]
mov eax, 0x418aa8
call fcn.004042f4
mov edx, dword [0x418aa8]
mov eax, esi
call fcn.004105e8
mov eax, esi
call fcn.00403704
push 2
mov eax, dword [0x418aa8]
call fcn.004046b4
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4123b2
test bl, bl
je 0x41242b
lea eax, [ebp - 0x24]
call fcn.00410f14
mov eax, dword [ebp - 0x24]
call fcn.004046b4
push eax
push 0x412474
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x412484
push dword [0x418aa8]
push 0x41249c
lea eax, [ebp - 0x28]
mov edx, dword [0x413bb0]
mov edx, dword [edx]
call fcn.00404498
push dword [ebp - 0x28]
push 0x4124a8
mov eax, 0x418aac
mov edx, 5
call main
mov eax, dword [0x418aac]
call fcn.00411490
mov ebx, eax
mov eax, dword [0x418aa8]
call fcn.004046b4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x413a88]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41244d
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.004042c4
ret
Function at 0x412640
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
jmp 0x41265a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412661
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412650
mov eax, 1
add ebx, ebx
jne 0x412673
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412668
jne 0x412684
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412668
xor ecx, ecx
sub eax, 3
jb 0x412698
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41270a
mov ebp, eax
add ebx, ebx
jne 0x4126a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4126b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4126d4
inc ecx
add ebx, ebx
jne 0x4126c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4126b5
jne 0x4126d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4126b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4126f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4126e5
jmp 0x412656
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4126f4
add edi, ecx
jmp 0x412656
pop esi
mov edi, esi
mov ecx, 0x347
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x412712
cmp byte [edi], 5
jne 0x412712
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x412717
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412786
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x121b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x121e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412744
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x121e8]
or eax, eax
je 0x412780
mov dword [ebx], eax
add ebx, 4
jmp 0x412761
call dword [esi + 0x121e4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4127b7
cmp al, 0xef
ja 0x4127aa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x41278c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x412799
mov ebp, dword [esi + 0x121ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4127eb
sub esp, 0xffffff80
jmp 0x401f30
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x710c59
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7109ec
sub esi, 0x98c2cee9
and ebx, esi
call fcn.00710ca6
sub ebx, 0x7b980b0f
xor dword [edx], edi
and ebx, ebx
add ebx, 0xf187fdea
or ebx, ebx
inc edx
and ebx, esi
add esi, esi
cmp edx, ecx
jne fcn.00710c59
sub esi, 0x19a6563f
push 0x194cbbe6
pop ebx
and ebx, ebx
ret
Function at 0x47f030
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov eax, dword [0xbd33e0]
xor eax, ebp
mov dword [esp + 0xf0], eax
call fcn.004ab2df
cmp eax, 2
jne 0x47f152
lea eax, [esp + 0x70]
push pe_nt_image_headers32
push eax
call fcn.00624769
add esp, 8
push eax
push 2
push 0
call fcn.006bd134
add esp, 0xc
test eax, eax
mov ebx, 0
mov dword [esp], 0
je 0x47f11e
mov esi, eax
push str.SELECT_value_FROM_configuration_WHERE_entry___cookie_
push eax
call fcn.006bdcb2
add esp, 8
test eax, eax
jne 0x47f0a6
xor ebx, ebx
jmp 0x47f115
mov edi, eax
xor ebx, ebx
push eax
call fcn.006be9d3
add esp, 4
cmp eax, 0x3e9
je 0x47f10c
cmp eax, 0x3e8
jne 0x47f0f5
push 0
push edi
call fcn.006bfeec
add esp, 8
lea ebx, [esp + 0x30]
mov dword [esp + 4], eax
push 0x40
push ebx
call fcn.00499471
add esp, 8
push ebx
push dword [esp + 8]
call fcn.00989f30
add esp, 8
xor ebx, ebx
test eax, eax
setne bl
jmp 0x47f10c
push esi
call fcn.006bd55e
add esp, 4
push eax
push str.Failed_to_get_the_cookie_in_the_configuration_table.__s_n
call fcn.00447218
add esp, 8
push edi
call fcn.006bdcf4
add esp, 4
push esi
call fcn.006bd40c
add esp, 4
call fcn.0047aaa8
lea ecx, [esp + 8]
push ecx
push eax
call fcn.00981410
add esp, 8
test eax, eax
jne 0x47f188
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
call fcn.004993cf
xor edx, edi
xor eax, esi
xor ecx, ecx
or eax, edx
setne cl
mov dword [esp], ecx
jmp 0x47f188
call fcn.0047aaa8
lea ecx, [esp + 8]
push ecx
push eax
call fcn.00981410
add esp, 8
test eax, eax
jne 0x47f1a6
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
call fcn.004993cf
xor edx, edi
xor eax, esi
xor ebx, ebx
mov dword [esp], 0
or eax, edx
setne bl
test ebx, ebx
je 0x47f19b
call fcn.0047d655
call fcn.0047dcc8
call fcn.004aa9fa
cmp dword [esp], 0
je 0x47f1a6
call fcn.0047dccf
mov ecx, dword [esp + 0xf0]
xor ecx, ebp
call fcn.00989fe9
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x480b53
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x404
mov eax, dword [0xbd33e0]
lea edi, [ebp - 0x410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x400
push edi
call fcn.004ab991
add esp, 8
mov bl, byte [edi]
xor esi, esi
mov eax, edi
test bl, bl
cmove eax, esi
push eax
call fcn.00846f60
add esp, 4
test eax, eax
je 0x480bdd
test bl, bl
mov eax, 0xb79e70
cmove edi, eax
call fcn.00981400
cmp eax, 2
jne 0x480bbc
push edi
push str.MySQL_library__s_not_found_n
call fcn.0044734f
add esp, 8
call fcn.00480f07
call fcn.009813f0
mov esi, eax
call fcn.00980fe0
push esi
push eax
push edi
push str.Failed_to_load_the_MySQL_library__s__syserr__d__s__n
call fcn.0044734f
add esp, 0x10
call fcn.00480f07
push esi
push esi
push esi
call dword [0xc2c54c]
test eax, eax
je 0x480bfc
push str.Failed_to_initialize_the_client_library_in_the_MySQL_database_n
call fcn.0044734f
add esp, 4
call fcn.00480f07
call dword [0xc2c544]
test eax, eax
jne 0x480c0d
push str.Failed_to_initialize_threads_in_the_MySQL_database_n
jmp 0x480bef
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00989fe9
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5ec5e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x5ec61b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x5ec602
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x5ec613
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x5ec61d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x5ec5f8
xor eax, eax
pop edi
pop esi
ret

Function at 0x5ec661
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.005ec5a0
arpl word gs:[edi + 0x63], bp
push esi
push ebx
call fcn.005ec5e0
pop ecx
test eax, eax
pop ecx
je 0x5ec733
push edi
push esi
push ebx
call fcn.005ec620
add esp, 0xc
call fcn.005ec5a0
add byte [esi], bh
add eax, 0x78768bc8
test esi, esi
je 0x5ec733
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.005ec5a0
mov dh, 0
rol cl, cl
mov eax, dword [esi + 0x20]
add eax, edi
mov edi, dword [esi + 0x1c]
add edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
je 0x5ec742
and dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
call fcn.005ec5a0
xor ebx, dword [esi]
invalid
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x10]
add eax, ebx
cmp dword [ebp + 0xc], eax
jne 0x5ec762
call fcn.005ec5a0
push 0x8bb16b9c
inc ebp
invalid
mov eax, dword [esi + 0x14]
add dword [ebp - 0x10], 4
inc ebx
dec eax
cmp ebx, eax
jbe 0x5ec747
jmp 0x5ec733

Function at 0x5ecda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
call fcn.005ec57e
inc ebx
Function at 0x5ecdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
call fcn.005ec57e
inc ebx
Function at 0x770600
Capabilities:
Hash data with crc32

Disassembly:
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0xb49048]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0xb49048]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0xb49048]
mov eax, ecx
movzx edx, cl
shr eax, 8
xor eax, dword [edx*4 + 0xb49048]
ret
Function at 0x77c570
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov edi, ecx
mov ecx, dword [0xbd33e0]
mov eax, dword [esp + 0x34]
mov esi, edx
xor ecx, esp
mov dword [esp + 0x20], ecx
movzx ecx, word [eax]
lea edx, [ecx + ecx]
mov word [esp + 2], dx
movzx edx, word [eax + 2]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 4], dx
movzx edx, word [eax + 4]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 6], dx
movzx edx, word [eax + 6]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 8], dx
movzx edx, word [eax + 8]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0xa], dx
movzx edx, word [eax + 0xa]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0xc], dx
movzx edx, word [eax + 0xc]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0xe], dx
movzx edx, word [eax + 0xe]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0x10], dx
movzx edx, word [eax + 0x10]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0x12], dx
movzx edx, word [eax + 0x12]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0x14], dx
movzx edx, word [eax + 0x14]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0x16], dx
movzx edx, word [eax + 0x16]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0x18], dx
movzx edx, word [eax + 0x18]
lea ecx, [edx + ecx*2]
lea edx, [ecx + ecx]
mov word [esp + 0x1a], dx
movzx edx, word [eax + 0x1a]
lea ecx, [edx + ecx*2]
add ecx, ecx
mov word [esp + 0x1c], cx
add cx, word [eax + 0x1c]
add ecx, ecx
test esi, esi
mov word [esp + 0x1e], cx
js 0x77c68c
xor ebx, ebx
movzx edx, word [edi + ebx*4 + 2]
test edx, edx
je 0x77c685
movzx ecx, word [esp + edx*2]
lea eax, [ecx + 1]
mov word [esp + edx*2], ax
call fcn.0077c6a0
mov word [edi + ebx*4], ax
cmp ebx, esi
lea ebx, [ebx + 1]
jne 0x77c668
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00989fe9
add esp, 0x24
pop esi
pop edi
pop ebx
ret