joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f430
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x1002f475
cmp byte [esi + 1], 0
je 0x1002f47d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x1002f491
cmp byte [esi + 1], 0
je 0x1002f483
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x1002f49a
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], ecx
jmp 0x1002f44e
xor eax, eax
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x1002f49a
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x1002f4ae
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call dword [sym.imp.MSVCR90.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1002f4ca
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0
cmp edi, eax
jbe 0x1002f5dc
jmp 0x1002f4ed
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x1002f4fe
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x1002f517
mov ebp, 0x404
cmp byte [esi], 0
je 0x1002f53c
cmp byte [esi + 1], 0
je 0x1002f5dc
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1002f53f
mov dword [esi + 0x18], eax
cmp byte [esi], 0
mov edi, ebp
je 0x1002f567
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002f561
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x1002f58d
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x1002f578
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x10]
push edi
add ecx, eax
push ecx
push ebx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x1002f5dc
lea eax, [ebp - 3]
test eax, eax
jle 0x1002f5ce
lea ecx, [ecx]
dec eax
cmp byte [eax + ebx], 0x50
jne 0x1002f5bc
cmp byte [eax + ebx + 1], 0x4b
jne 0x1002f5bc
cmp byte [eax + ebx + 2], 5
jne 0x1002f5bc
cmp byte [eax + ebx + 3], 6
je 0x1002f5c2
test eax, eax
jg 0x1002f5a0
jmp 0x1002f5ce
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
jne 0x1002f5dc
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x1002f4e1
push ebx
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x10030510
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [esi], 0
push edi
jne 0x10030570
cmp dword [esi + 4], 0xffffffff
jne 0x10030570
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10030532
mov eax, dword [0x100f6648]
mov dword [edi], eax
mov eax, dword [esp + 0xc]
lea edi, [esp + 0xc]
call fcn.1002efd0
test eax, eax
jne 0x1003055f
mov eax, dword [esp + 0xc]
pop edi
pop ecx
ret 4
call fcn.1002f600
mov dword [esi], eax
mov eax, dword [0x10122710]
pop edi
pop ecx
ret 4
mov eax, 0x1000000
pop edi
pop ecx
ret 4
Function at 0x100343f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x100343f7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x100344d4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100fc500]
inc ecx
sub edx, 8
sub esi, 1
jne 0x10034410
pop edi
test edx, edx
je 0x100344fb
jmp 0x100344e0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x100fc500]
inc ecx
sub edx, 1
jne 0x100344e0
not eax
pop esi
ret

Function at 0x10034500
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x100fc500]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100fc500]
mov dword [edx + 8], ecx
ret
Function at 0x10034750
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1003477a
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor edi, edi
and edx, 1
je 0x10034793
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x14]
test al, 2
je 0x1003479a
or edi, 2
test al, 4
je 0x100347a1
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x100347ab
or edi, 0x10
test al, 0x20
je 0x100347b2
or edi, 0x20
test ecx, ecx
je 0x100347be
or edi, 0x40000000
jmp 0x100347c4
or edi, 0x80000000
or edi, 0x1000000
mov dword [esp + 0x14], edi
test edx, edx
jne 0x100347dc
or edi, 0x800000
mov dword [esp + 0x14], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
cmp eax, 0x28
jbe 0x10034890
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x1003488c
mov eax, dword [esp + 0x20]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x1c], ecx
jbe 0x1003488c
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x10034884
cmp eax, 0x454e
je 0x10034884
cmp eax, 0x454c
je 0x10034884
cmp eax, 0x4550
jne 0x1003488c
or dword [esp + 0x14], 0x400000
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x1003489a
mov dword [eax], edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x100348a8
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
test ebp, ebp
je 0x10034926
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.100e90d0
mov dword [ebp + 4], edx
push 0
mov ecx, edi
sub ecx, 0xd53e8000
mov edx, esi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebp], eax
call fcn.100e90d0
mov ecx, dword [esp + 0x30]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x2c]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [ebp + 0xc], edx
call fcn.100e90d0
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x10034953
push esi
push edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.100346e0
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x24]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [ebx], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x10034b90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x10034c6b
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x10034bc4
cmp dword [esi + 0x40], edi
jae 0x10034bc4
push eax
call sub.mfc90u.dll_delete__
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x10034bdb
lea eax, [edi + edi]
push eax
call sub.mfc90u.dll_new__
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
cmp edi, ebp
jbe 0x10034c67
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x100fc500]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x100fc500]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x10034bf0
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x10034ca4
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x10034c8c
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10034cc5
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x10035160
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x100351ae
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x100351eb
sub edi, eax
cmp edi, edx
jbe 0x10035184
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call sub.MSVCR90.dll_memcpy
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.100343f0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x100351e4
push 0
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100351eb
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.100343f0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ecx
ret
Function at 0x10037350
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x10037371
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov dword [esi + 0x28], ebx
cmp ebp, ebx
je 0x10037457
movzx eax, byte [ebp]
push eax
call dword [sym.imp.MSVCR90.dll_isalpha]
add esp, 4
test eax, eax
jne 0x10037399
cmp byte [ebp], 0x5f
mov dword [esp + 0x14], 1
jne 0x1003739d
mov dword [esp + 0x14], ebx
push edi
cmp byte [ebp], bl
je 0x100373db
mov esi, dword [sym.imp.MSVCR90.dll_isalnum]
mov edi, ebp
jmp 0x100373b0
movzx ecx, byte [edi]
push ecx
call esi
add esp, 4
test eax, eax
jne 0x100373d0
mov al, byte [edi]
cmp al, 0x5f
je 0x100373d0
mov dword [esp + 0x18], 1
cmp al, 0x27
jne 0x100373d0
inc ebx
inc edi
inc ebx
cmp byte [edi], 0
jne 0x100373b0
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100373e6
add ebx, 2
inc ebx
push ebx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x10037418
push str.Error:_out_of_memory_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR90.dll_exit]
xor ecx, ecx
test edi, edi
je 0x10037426
mov byte [eax], 0x27
mov ecx, 1
cmp byte [ebp], 0
je 0x10037446
mov esi, ebp
mov edi, edi
mov dl, byte [esi]
mov byte [eax + ecx], dl
inc ecx
cmp byte [esi], 0x27
jne 0x10037440
mov byte [eax + ecx], 0x27
inc ecx
inc esi
cmp byte [esi], 0
jne 0x10037430
cmp dword [esp + 0x18], 0
je 0x10037452
mov byte [eax + ecx], 0x27
inc ecx
mov byte [eax + ecx], 0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10038770
Capabilities:
Terminate process

Disassembly:
cmp dword [esi], 0
jne 0x1003881d
call fcn.100a0ee0
mov eax, dword [esi + 0x614]
push 0
push 6
push esi
push eax
call fcn.100a33c0
mov eax, dword [esi]
add esp, 0x10
mov dword [0x10122728], eax
test eax, eax
je 0x100387ec
push eax
call fcn.100a2b20
add esp, 4
test eax, eax
jne 0x100387ca
mov ecx, dword [0x10122728]
push eax
push eax
push eax
push 0x100364d0
push eax
push 1
push eax
push str.shellstatic
push ecx
call fcn.100a21e0
add esp, 0x24
mov eax, dword [0x10122728]
test eax, eax
je 0x100387ec
push eax
call fcn.100a2b20
add esp, 4
test eax, eax
jne 0x100387e7
mov eax, dword [esi]
jmp 0x10082f20
mov eax, dword [0x10122728]
push eax
call fcn.100a28b0
mov edx, dword [esi + 0x614]
add esp, 4
push eax
push edx
push str.Error:_unable_to_open_database___s_:__s_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0x10
push 1
call dword [sym.imp.MSVCR90.dll_exit]
ret
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10082f34
push eax
call dword [0x1011f230]
add esp, 4
or dword [esi + 0x18], 0x400000
mov esi, dword [esi + 0xc]
test esi, esi
je 0x10082f4c
push esi
call dword [0x1011f238]
add esp, 4
xor eax, eax
pop esi
ret
Function at 0x10038cb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
inc ecx
cmp ecx, eax
push ebx
push edi
jl 0x10038d0b
mov ebx, dword [esi + 8]
lea edi, [eax + eax + 0x64]
mov dword [esi + 0x10], edi
call fcn.100a0ee0
test eax, eax
je 0x10038cda
xor eax, eax
jmp 0x10038ce4
push edi
push ebx
call fcn.1003fc90
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x10038d0b
push str.out_of_memory_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov cl, byte [ebp + 8]
mov byte [eax + edx], cl
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042ed0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x10042efd
push esi
push edi
jmp 0x10042ee0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x100f8858]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x10042ee0
pop edi
pop esi
ret

Function at 0x10042f60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x10042f7d
mov esi, 0x80
cmp esi, dword [edi]
jne 0x10042f8a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x10122790]
test eax, eax
je 0x10042f95
call eax
lea ecx, [esi*8]
push ecx
call fcn.1003f850
mov ebp, eax
mov eax, dword [0x10122794]
add esp, 4
mov dword [esp + 0x10], ebp
test eax, eax
je 0x10042fb6
call eax
test ebp, ebp
je 0x10042f81
mov edx, dword [edi + 0xc]
push edx
call fcn.1003fb70
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x1011f20c]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call sub.MSVCR90.dll_memset
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x1004309f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x10043033
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x100f8858]
lea ebp, [eax*8]
xor ebx, ebp
dec edx
xor eax, ebx
inc esi
test edx, edx
jg 0x10043010
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x1004307a
mov esi, dword [eax]
test esi, esi
je 0x10043050
mov edx, dword [eax + 4]
jmp 0x10043052
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x1004307a
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x10043072
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x10043093
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x10043093
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x10043089
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x10043003
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x10055280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x34]
push edi
mov edi, eax
push esi
lea eax, [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.10050230
mov ax, word [esp + 0x3c]
add esp, 4
test ax, ax
je 0x10055325
movzx ecx, word [esi + 0x12]
add ecx, dword [esi + 0x38]
movzx eax, ax
add eax, edi
lea edx, [eax + 3]
cmp edx, ecx
jbe 0x100552e8
push 0x10104140
push 0xd6e8
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.10041420
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, byte [eax]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl esi, 8
or esi, ecx
mov ecx, dword [ebx + 0x24]
shl esi, 8
or esi, edx
movzx edx, word [esp + 0x36]
shl esi, 8
or esi, eax
mov eax, dword [esp + 0x30]
sub ecx, 4
sub eax, edx
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
xor ecx, ecx
cmp eax, ecx
jne 0x1005533a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
xor ecx, ecx
dec eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
cmp esi, 2
jb 0x10055426
cmp esi, dword [ebx + 0x2c]
ja 0x10055426
cmp eax, ecx
je 0x1005537e
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
mov edi, ebx
call fcn.10053650
add esp, 0xc
test eax, eax
jne 0x10055327
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x1005538d
call fcn.10050ec0
mov ebx, dword [esp + 0x10]
mov edi, eax
test edi, edi
je 0x100553b7
mov eax, dword [edi + 0x44]
cmp word [eax + 0x1a], 1
je 0x100553b7
push 0x10104140
push 0xd70a
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.10041420
add esp, 0x10
mov ebx, 0xb
jmp 0x100553c5
push esi
push ebx
mov eax, edi
call fcn.10054f40
add esp, 8
mov ebx, eax
test edi, edi
je 0x10055402
mov eax, dword [edi + 0x44]
test eax, eax
je 0x10055402
test byte [eax + 0x18], 0x40
mov esi, dword [eax + 0x10]
je 0x100553e2
mov ecx, eax
call fcn.1004a950
jmp 0x100553e7
call fcn.10046cf0
cmp dword [esi + 0x78], 0
jne 0x10055402
mov ecx, dword [esi + 0xcc]
cmp dword [ecx + 0xc], 0
jne 0x10055402
push esi
call fcn.100491d0
add esp, 4
test ebx, ebx
jne 0x1005541d
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], ebx
jne 0x10055330
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10104140
push 0xd6f6
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.10041420
add esp, 0x10
pop edi
pop esi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100670e0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push esi
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0x48]
mov esi, dword [eax + 0x34]
test ecx, ecx
je 0x10067100
push esi
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edi
call fcn.1005e1c0
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x10067135
movzx ecx, word [edi + 6]
xor edx, edx
xor eax, eax
mov word [esi + 4], cx
cmp dx, cx
jae 0x10067131
mov ecx, dword [esi + 0x10]
add ecx, 0x1c
mov edi, edi
test byte [ecx], 1
jne 0x1006714e
movzx edx, word [esi + 4]
inc eax
add ecx, 0x28
cmp eax, edx
jl 0x10067120
or byte [esi + 6], 2
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
push eax
push ecx
call fcn.1005e2b0
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ecx
ret
pop edi
mov dword [ebx], 0xffffffff
pop esi
pop ecx
ret