joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026da4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012007c]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], 2
mov byte [esp + 0x1a], 4
mov byte [esp + 0x1b], 8
mov byte [esp + 0x1c], 0x10
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x40
mov byte [esp + 0x1f], 0x80
mov byte [esp + 0x20], 0x1b
mov byte [esp + 0x21], 0x36
add eax, 4
lea ecx, [esi + 2]
mov edi, 4
movzx edx, byte [eax - 4]
mov byte [ecx - 2], dl
movzx edx, byte [eax]
mov byte [ecx - 1], dl
movzx edx, byte [eax + 4]
mov byte [ecx], dl
movzx edx, byte [eax + 8]
mov byte [ecx + 1], dl
inc eax
add ecx, 4
sub edi, 1
jne 0x10026de5
lea ebp, [esp + 0x18]
add esi, 4
mov edi, 1
dec ebp
xor eax, eax
test eax, eax
je 0x10026e21
mov cl, byte [esi + eax + 0xb]
jmp 0x10026e24
mov cl, byte [esi - 1]
test eax, eax
je 0x10026e2e
mov dl, byte [esi + eax + 0xf]
jmp 0x10026e31
mov dl, byte [esi + 3]
mov byte [esp + 0x15], dl
test eax, eax
je 0x10026e3f
mov dl, byte [esi + eax + 0x13]
jmp 0x10026e42
mov dl, byte [esi + 7]
mov bl, dl
mov byte [esp + 0x16], bl
test eax, eax
je 0x10026e52
mov dl, byte [esi + eax + 0x17]
jmp 0x10026e55
mov dl, byte [esi + 0xb]
test eax, eax
jne 0x10026e91
movzx edx, dl
movzx edx, byte [edx + str.cw]
mov byte [esp + 0x13], cl
movzx ecx, byte [esp + 0x15]
mov cl, byte [ecx + str.cw]
xor cl, byte [edi + ebp]
movzx ebx, bl
mov bl, byte [ebx + str.cw]
mov byte [esp + 0x16], dl
movzx edx, byte [esp + 0x13]
mov dl, byte [edx + str.cw]
mov byte [esp + 0x15], bl
mov bl, byte [esi + eax - 4]
xor bl, cl
movzx ecx, byte [esi + eax]
xor cl, byte [esp + 0x15]
mov byte [esi + eax + 0xc], bl
mov byte [esi + eax + 0x10], cl
movzx ecx, byte [esi + eax + 4]
xor cl, byte [esp + 0x16]
inc eax
mov byte [esi + eax + 0x13], cl
movzx ecx, byte [esi + eax + 7]
xor cl, dl
cmp eax, 4
mov byte [esi + eax + 0x17], cl
jl 0x10026e17
inc edi
add esi, 0x10
cmp edi, 0xa
jle 0x10026e15
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100e7da2
add esp, 0x18
ret 4

Function at 0x10028b80
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0xc], 0x67452301
mov dword [ecx + 0x10], 0xefcdab89
mov dword [ecx + 0x14], 0x98badcfe
mov dword [ecx + 0x18], 0x10325476
mov eax, 1
ret 4
Function at 0x10029620
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x10]
push edi
mov ebx, eax
xor ecx, ecx
mov edi, 0x5000
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
add esp, 4
mov esi, eax
mov eax, dword [ebp]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp eax, 0x4ffe
jne 0x100296b0
push esi
call sub.mfc90u.dll_delete__
add esp, 4
cmp edi, 0x100000
jge 0x10029675
add edi, edi
jmp 0x1002967b
add edi, 0x100000
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
mov esi, eax
add esp, 4
test esi, esi
je 0x100296db
mov eax, dword [ebp]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
lea ecx, [edi - 2]
cmp eax, ecx
je 0x10029660
lea ebx, [ebp + 4]
mov eax, esi
call fcn.10029470
push esi
test eax, eax
je 0x100296d3
call sub.mfc90u.dll_delete__
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
call sub.mfc90u.dll_delete__
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4

Function at 0x1002a980
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp byte [edi + 4], 0
push esi
mov esi, ecx
jne 0x1002a9aa
push 0x10121bcc
lea ecx, [esp + 8]
call dword [sym.imp.MSVCR90.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x101125dc
lea eax, [esp + 8]
push eax
call sub.MSVCR90.dll__CxxThrowException
xor ecx, ecx
cmp dword [edi + 0x3cc], ecx
jle 0x1002a9c3
mov dl, byte [esi]
xor byte [eax], dl
inc ecx
inc esi
inc eax
cmp ecx, dword [edi + 0x3cc]
jl 0x1002a9b4
pop esi
add esp, 0xc
ret
Function at 0x1002e9e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x1002e9e7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x1002eac4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fecb0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x1002ea00
pop edi
test edx, edx
je 0x1002eaeb
jmp 0x1002ead0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x100fecb0]
inc ecx
sub edx, 1
jne 0x1002ead0
not eax
pop esi
ret

Function at 0x1002f380
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x1002f3b2
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002f3a8
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x1002f3c5
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
push esi
add eax, ecx
push eax
push edx
call sub.MSVCR90.dll_memcpy
add dword [edi + 0x18], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x1002f630
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x1002f675
cmp byte [esi + 1], 0
je 0x1002f67d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x1002f691
cmp byte [esi + 1], 0
je 0x1002f683
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x1002f69a
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], ecx
jmp 0x1002f64e
xor eax, eax
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x1002f69a
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x1002f6ae
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call dword [sym.imp.MSVCR90.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1002f6ca
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0
cmp edi, eax
jbe 0x1002f7dc
jmp 0x1002f6ed
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x1002f6fe
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x1002f717
mov ebp, 0x404
cmp byte [esi], 0
je 0x1002f73c
cmp byte [esi + 1], 0
je 0x1002f7dc
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1002f73f
mov dword [esi + 0x18], eax
cmp byte [esi], 0
mov edi, ebp
je 0x1002f767
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002f761
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x1002f78d
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x1002f778
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x10]
push edi
add ecx, eax
push ecx
push ebx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x1002f7dc
lea eax, [ebp - 3]
test eax, eax
jle 0x1002f7ce
lea ecx, [ecx]
dec eax
cmp byte [eax + ebx], 0x50
jne 0x1002f7bc
cmp byte [eax + ebx + 1], 0x4b
jne 0x1002f7bc
cmp byte [eax + ebx + 2], 5
jne 0x1002f7bc
cmp byte [eax + ebx + 3], 6
je 0x1002f7c2
test eax, eax
jg 0x1002f7a0
jmp 0x1002f7ce
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
jne 0x1002f7dc
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x1002f6e1
push ebx
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x10030710
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [esi], 0
push edi
jne 0x10030770
cmp dword [esi + 4], 0xffffffff
jne 0x10030770
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10030732
mov eax, dword [0x100f7648]
mov dword [edi], eax
mov eax, dword [esp + 0xc]
lea edi, [esp + 0xc]
call fcn.1002f1d0
test eax, eax
jne 0x1003075f
mov eax, dword [esp + 0xc]
pop edi
pop ecx
ret 4
call fcn.1002f800
mov dword [esi], eax
mov eax, dword [0x10123710]
pop edi
pop ecx
ret 4
mov eax, 0x1000000
pop edi
pop ecx
ret 4

Function at 0x10030c10
Capabilities:
Create directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x1012007c]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x41c]
push edi
mov edi, dword [esp + 0x424]
test edi, edi
je 0x10030cfd
movzx eax, word [edi]
test ax, ax
je 0x10030cfd
push esi
mov esi, edi
mov ecx, edi
movzx eax, ax
cmp ax, 0x2f
je 0x10030c5c
cmp ax, 0x5c
jne 0x10030c5e
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x10030c50
cmp esi, edi
je 0x10030c94
sub esi, edi
sar esi, 1
push esi
lea eax, [esp + 0x10]
push edi
push eax
call dword [sym.imp.MSVCR90.dll_wcsncpy]
lea edx, [esp + 0x18]
push edx
xor ecx, ecx
push ebx
mov word [esp + esi*2 + 0x20], cx
call fcn.10030c10
add esp, 0x14
lea edx, [esp + 0x214]
mov eax, ebx
sub edx, ebx
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10030ca0
mov eax, edi
mov edx, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10030cb3
lea edi, [esp + 0x214]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10030cd0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [esp + 0x218]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [esp + 0x418]
pop edi
pop ebx
xor ecx, esp
call fcn.100e7da2
add esp, 0x414
ret
Function at 0x100345f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x100345f7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x100346d4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fd500]
inc ecx
sub edx, 8
sub esi, 1
jne 0x10034610
pop edi
test edx, edx
je 0x100346fb
jmp 0x100346e0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x100fd500]
inc ecx
sub edx, 1
jne 0x100346e0
not eax
pop esi
ret

Function at 0x10034700
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x100fd500]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100fd500]
mov dword [edx + 8], ecx
ret
Function at 0x10034950
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1003497a
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor edi, edi
and edx, 1
je 0x10034993
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x14]
test al, 2
je 0x1003499a
or edi, 2
test al, 4
je 0x100349a1
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x100349ab
or edi, 0x10
test al, 0x20
je 0x100349b2
or edi, 0x20
test ecx, ecx
je 0x100349be
or edi, 0x40000000
jmp 0x100349c4
or edi, 0x80000000
or edi, 0x1000000
mov dword [esp + 0x14], edi
test edx, edx
jne 0x100349dc
or edi, 0x800000
mov dword [esp + 0x14], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
cmp eax, 0x28
jbe 0x10034a90
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x10034a8c
mov eax, dword [esp + 0x20]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x1c], ecx
jbe 0x10034a8c
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x10034a84
cmp eax, 0x454e
je 0x10034a84
cmp eax, 0x454c
je 0x10034a84
cmp eax, 0x4550
jne 0x10034a8c
or dword [esp + 0x14], 0x400000
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x10034a9a
mov dword [eax], edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x10034aa8
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
test ebp, ebp
je 0x10034b26
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.100e95c0
mov dword [ebp + 4], edx
push 0
mov ecx, edi
sub ecx, 0xd53e8000
mov edx, esi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebp], eax
call fcn.100e95c0
mov ecx, dword [esp + 0x30]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x2c]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [ebp + 0xc], edx
call fcn.100e95c0
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x10034b53
push esi
push edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.100348e0
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x24]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [ebx], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x10034d90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x10034e6b
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x10034dc4
cmp dword [esi + 0x40], edi
jae 0x10034dc4
push eax
call sub.mfc90u.dll_delete__
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x10034ddb
lea eax, [edi + edi]
push eax
call sub.mfc90u.dll_new__
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
cmp edi, ebp
jbe 0x10034e67
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x100fd500]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x100fd500]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x10034df0
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x10034ea4
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x10034e8c
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10034ec5
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x10035360
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x100353ae
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x100353eb
sub edi, eax
cmp edi, edx
jbe 0x10035384
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call sub.MSVCR90.dll_memcpy
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.100345f0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x100353e4
push 0
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100353eb
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.100345f0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ecx
ret
Function at 0x10037550
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x10037571
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov dword [esi + 0x28], ebx
cmp ebp, ebx
je 0x10037657
movzx eax, byte [ebp]
push eax
call dword [sym.imp.MSVCR90.dll_isalpha]
add esp, 4
test eax, eax
jne 0x10037599
cmp byte [ebp], 0x5f
mov dword [esp + 0x14], 1
jne 0x1003759d
mov dword [esp + 0x14], ebx
push edi
cmp byte [ebp], bl
je 0x100375db
mov esi, dword [sym.imp.MSVCR90.dll_isalnum]
mov edi, ebp
jmp 0x100375b0
movzx ecx, byte [edi]
push ecx
call esi
add esp, 4
test eax, eax
jne 0x100375d0
mov al, byte [edi]
cmp al, 0x5f
je 0x100375d0
mov dword [esp + 0x18], 1
cmp al, 0x27
jne 0x100375d0
inc ebx
inc edi
inc ebx
cmp byte [edi], 0
jne 0x100375b0
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100375e6
add ebx, 2
inc ebx
push ebx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x10037618
push str.Error:_out_of_memory_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR90.dll_exit]
xor ecx, ecx
test edi, edi
je 0x10037626
mov byte [eax], 0x27
mov ecx, 1
cmp byte [ebp], 0
je 0x10037646
mov esi, ebp
mov edi, edi
mov dl, byte [esi]
mov byte [eax + ecx], dl
inc ecx
cmp byte [esi], 0x27
jne 0x10037640
mov byte [eax + ecx], 0x27
inc ecx
inc esi
cmp byte [esi], 0
jne 0x10037630
cmp dword [esp + 0x18], 0
je 0x10037652
mov byte [eax + ecx], 0x27
inc ecx
mov byte [eax + ecx], 0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10038970
Capabilities:
Terminate process

Disassembly:
cmp dword [esi], 0
jne 0x10038a1d
call fcn.100a1140
mov eax, dword [esi + 0x614]
push 0
push 6
push esi
push eax
call fcn.100a3620
mov eax, dword [esi]
add esp, 0x10
mov dword [0x10123728], eax
test eax, eax
je 0x100389ec
push eax
call fcn.100a2d80
add esp, 4
test eax, eax
jne 0x100389ca
mov ecx, dword [0x10123728]
push eax
push eax
push eax
push 0x100366d0
push eax
push 1
push eax
push str.shellstatic
push ecx
call fcn.100a2440
add esp, 0x24
mov eax, dword [0x10123728]
test eax, eax
je 0x100389ec
push eax
call fcn.100a2d80
add esp, 4
test eax, eax
jne 0x100389e7
mov eax, dword [esi]
jmp 0x10083170
mov eax, dword [0x10123728]
push eax
call fcn.100a2b10
mov edx, dword [esi + 0x614]
add esp, 4
push eax
push edx
push str.Error:_unable_to_open_database___s_:__s_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0x10
push 1
call dword [sym.imp.MSVCR90.dll_exit]
ret
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10083184
push eax
call dword [0x10120230]
add esp, 4
or dword [esi + 0x18], 0x400000
mov esi, dword [esi + 0xc]
test esi, esi
je 0x1008319c
push esi
call dword [0x10120238]
add esp, 4
xor eax, eax
pop esi
ret
Function at 0x10038eb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
inc ecx
cmp ecx, eax
push ebx
push edi
jl 0x10038f0b
mov ebx, dword [esi + 8]
lea edi, [eax + eax + 0x64]
mov dword [esi + 0x10], edi
call fcn.100a1140
test eax, eax
je 0x10038eda
xor eax, eax
jmp 0x10038ee4
push edi
push ebx
call fcn.1003fe90
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x10038f0b
push str.out_of_memory_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov cl, byte [ebp + 8]
mov byte [eax + edx], cl
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov esp, ebp
pop ebp
ret