joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011e0b0
Capabilities:
Reference sql statements

Disassembly:
push ebx
push edi
push dword [esp + 0xc]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.10122f80
add esp, 0x18
cmp dword [esp + 0xc], 0
jne 0x1011e0ea
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.10122f80
add esp, 0x10
pop edi
pop ebx
ret

Function at 0x10123090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebx, ecx
mov ebp, edx
mov ecx, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], ebx
xor esi, esi
cmp dword [ebx + 0x14], esi
jle 0x1012312b
nop
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test ecx, ecx
je 0x101230e3
mov edx, edi
mov eax, ecx
mov ecx, dword [ebx + 0x10]
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [esp + 0x1c]
nop
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x10123108
test edx, edx
jne 0x1012311a
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x10]
add edi, edi
push 0
mov edx, ebp
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.100e7050
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x1012318a
jmp 0x10123121
movzx ecx, byte [ecx + 0x101e4df8]
movzx edx, byte [edx + 0x101e4df8]
sub edx, ecx
jne 0x1012311d
inc eax
jmp 0x101230d0
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
inc esi
cmp esi, dword [ebx + 0x14]
jl 0x101230b0
mov edx, str.sqlite_master
sub edx, ebp
movzx ecx, byte [ebp]
movzx eax, byte [edx + ebp]
cmp ecx, eax
jne 0x10123156
test ecx, ecx
jne 0x10123168
mov eax, dword [ebx + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x1012316b
neg eax
sbb eax, eax
jmp 0x1012317a
movzx eax, byte [eax + 0x101e4df8]
movzx ecx, byte [ecx + 0x101e4df8]
sub ecx, eax
jne 0x10123188
inc ebp
jmp 0x10123132
test eax, eax
je 0x10123188
mov edx, eax
call fcn.100e5bb0
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x10123188
mov ebp, str.sqlite_temp_master
jmp 0x101230a3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x101234d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, ecx
mov dword [esp + 4], edx
push ebx
push edi
xor ebx, ebx
mov dword [esp + 0x10], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x1012356a
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x10123529
mov esi, dword [esi]
mov eax, ebp
sub esi, ebp
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x10123555
test edx, edx
jne 0x10123567
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ecx, [eax + 0x18]
push 0
call fcn.100e7050
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x1012354b
mov eax, dword [esp + 0x18]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x101234f2
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
movzx ecx, byte [ecx + 0x101e4df8]
movzx edx, byte [edx + 0x101e4df8]
sub edx, ecx
jne 0x10123541
inc eax
jmp 0x10123516
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x10179b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push 0x38
xorps xmm0, xmm0
lea eax, [esp + 0x4c]
mov ebp, edx
movlpd qword [esp + 0x2c], xmm0
mov ebx, ecx
mov dword [esp + 0x20], ebp
push 0
movups xmmword [esp + 0x40], xmm0
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], 0x13
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x48]
mov edx, ebp
mov ecx, ebx
push eax
push 1
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esp + 0xa0]
call fcn.10169ff0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10179d5e
push dword [esp + 0x3c]
lea eax, [esp + 0x3c]
mov ecx, ebx
push dword [esp + 0x3c]
lea edx, [esp + 0x50]
mov dword [esp + 0x5c], eax
call fcn.10175670
mov esi, eax
add esp, 8
test esi, esi
jne 0x10179d5e
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.10175790
mov esi, eax
cmp esi, 0x64
jne 0x10179d5e
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov edi, dword [esp + 0x78]
lea edx, [esp + 0x20]
mov ebp, dword [esp + 0x7c]
xorps xmm0, xmm0
mov ecx, edi
movlpd qword [esp + 0x20], xmm0
add ebp, edi
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x28], xmm0
call fcn.10166240
lea esi, [edi + eax]
cmp esi, ebp
jae 0x10179d3e
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.10166240
add esi, eax
cmp esi, ebp
jae 0x10179d3a
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x10179ce6
cmp ecx, 1
jne 0x10179ca6
test edx, edx
je 0x10179ce6
mov eax, dword [esp + 0x28]
add ecx, 0xfffffffe
adc edx, 0xffffffff
add eax, ecx
mov ecx, dword [esp + 0x70]
adc dword [esp + 0x2c], edx
mov edx, dword [esp + 0x74]
push eax
push dword [esp + 0x34]
mov dword [esp + 0x30], eax
push edi
push ebx
push dword [esp + 0x98]
push dword [esp + 0x30]
call fcn.10179ad0
xor dword [esp + 0x2c], eax
add esp, 0x18
xor dword [esp + 0x10], edx
jmp 0x10179d32
xorps xmm0, xmm0
or ecx, edx
movlpd qword [esp + 0x30], xmm0
mov ecx, esi
movlpd qword [esp + 0x28], xmm0
je 0x10179d08
lea edx, [esp + 0x30]
call fcn.10166240
add esi, eax
jmp 0x10179d32
lea edx, [esp + 0x20]
call fcn.10166240
add esi, eax
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xef], 0
je 0x10179d2a
sub ebx, dword [esp + 0x20]
sbb edi, dword [esp + 0x24]
jmp 0x10179d32
add ebx, dword [esp + 0x20]
adc edi, dword [esp + 0x24]
cmp esi, ebp
jb 0x10179c71
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.10175790
mov esi, eax
cmp esi, 0x64
je 0x10179c34
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
jmp 0x10179d66
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x48]
call fcn.10175ef0
mov ecx, dword [esp + 0x8c]
mov edx, edi
pop edi
mov eax, ebp
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x10184310
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0x10], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov esi, ecx
mov dword [esp + 0x14], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
push edi
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x1018434c
push dword [esi + 8]
push dword [esi + 4]
push dword [esp + ebx*4 + 0x1c]
push esi
call fcn.10184230
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x1018440c
mov ebp, dword [esp + 0x24]
push ebp
push dword [esp + 0x24]
push 1
push edi
call fcn.10108730
push edi
call fcn.10107440
add esp, 0x14
cmp eax, 0x65
jne 0x101843a3
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebp
push ecx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.101842b0
add esp, 0x1c
jmp 0x101843fa
cmp eax, 0x64
jne 0x101843fa
push 0
push edi
call fcn.10107da0
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x28]
jne 0x101843c5
cmp edx, ecx
je 0x101843fa
push ecx
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test ebx, ebx
push ebp
push ecx
mov eax, str.__rowid
mov dword [esp + 0x20], str.__parent
cmove eax, dword [esp + 0x20]
push eax
push edx
push dword [esp + 0x2c]
push ebp
push ecx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.101842b0
add esp, 0x2c
push edi
call fcn.10106440
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x1018440c
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1018cb80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c19ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.10191670
lea esi, [edi + 4]
mov dword [edi], vtable.Poco::JSON::ParseHandler.0
push 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.1018b705
mov dword [esi], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
call fcn.100acaf0
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x34], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1019b970
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101c2448
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x1019bb48
je case.0x1019b9be.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x1019b9be.4
movzx eax, byte [eax + 0x1019bbe4]
jmp dword [eax*4 + 0x1019bba8]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10194620
push 0x1021cb00
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10194500
push 0x1021cbd8
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.101945d0
push 0x1021cab8
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.101941f0
push 0x1021cc20
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.101942c0
push 0x1021ccf8
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10194d10
push 0x1021cc68
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10194b20
push 0x1021ccb0
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.10014150
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.10194550
push 0x1021ca74
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.10014150
mov dword [ebp - 4], 1
jmp 0x1019ba8f
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.10014150
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.10194af0
push 0x1021ccb0
jmp 0x1019baa4
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.10014150
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.10194ce0
push 0x1021cc68
jmp 0x1019baa4
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.10014150
mov dword [ebp - 4], 4
jmp 0x1019ba8f
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.10194a30
push 0x1021c9ec
jmp 0x1019baa4
cmp esi, 0x781
je case.0x1019b9be.3
cmp esi, 0x1779
je 0x1019bb77
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.10194580
push 0x1021ca74
lea eax, [ebp - 0x90]
jmp 0x1019baa7
push 0x1779
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.10194670
push 0x1021cb90
jmp 0x1019baa4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.101949e0
push 0x1021cb48
jmp 0x1019baa4
Function at 0x101a1ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c2489
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.1018bdcd
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 2
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x101a2180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c2489
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x1000
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedBidirectionalStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0
call fcn.1018bdcd
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
call fcn.1018bdcd
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [esi + 0x44], eax
add ecx, 4
mov eax, dword [esi + 0xc]
mov dword [esi + 0x48], 3
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::FileStreamBuf.0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x101a2700
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x101a2761
mov ecx, dword [esi + 0x48]
test cl, 1
je 0x101a2761
test cl, 2
je 0x101a2723
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
mov eax, dword [esi + 0x68]
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101a2751
lea eax, [esi + 0x50]
push eax
call fcn.1019b960
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
pop ecx
ret 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc

Function at 0x101a2a40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x101a2aec
mov ecx, dword [esi + 0x48]
test cl, 2
je 0x101a2aec
test cl, 8
je 0x101a2aac
push 2
lea ecx, [esp + 0x10]
xorps xmm0, xmm0
push ecx
push 0
push eax
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x101a2a9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x101a2a9b
lea eax, [esi + 0x50]
push eax
call fcn.1019b960
add esp, 4
mov eax, dword [esp + 8]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x68]
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101a2ada
lea eax, [esi + 0x50]
push eax
call fcn.1019b960
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
add esp, 0xc
ret 0xc
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc

Function at 0x101a2d60
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
pop esi
ret
Function at 0xb2070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push edx
pop eax
push esi
sub eax, ebx
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x6d1dc
lea ebx, [ebx]
inc byte [ecx + 0x100]
movzx edi, byte [ecx + 0x100]
lea ebx, [ebx + 1]
movzx eax, byte [edi + ecx]
add byte [ecx + 0x101], al
movzx esi, byte [ecx + 0x101]
mov dl, byte [edi + ecx]
movzx eax, byte [esi + ecx]
mov byte [edi + ecx], al
mov byte [esi + ecx], dl
movzx eax, byte [ecx + 0x101]
movzx edx, byte [ecx + 0x100]
movzx eax, byte [eax + ecx]
add al, byte [edx + ecx]
mov edx, dword [ebp - 8]
movzx eax, al
movzx eax, byte [eax + ecx]
xor al, byte [edx + ebx - 1]
dec dword [ebp - 4]
mov byte [ebx - 1], al
jne 0xb2090
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb3070
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 4
push edi
inc eax
movzx eax, ax
push 6
push eax
push ebx
mov edi, ecx
call dword [0xbd010]
or eax, eax
je 0xb311c
push esi
push eax
pop edx
push ebx
pop ecx
call fcn.000b3680
push eax
pop ebx
add esp, 4
or ebx, ebx
je 0xb311c
movzx ecx, word [ebx]
push 0
push 0
push 0
push 0
push ecx
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [case.0xb3c78.0]
mov esi, eax
test esi, esi
js 0xb3125
mov eax, dword [edi]
pushfd
xor ecx, ecx
inc ecx
popfd
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0xb30e7
push esi
mov ecx, edi
call fcn.000b3430
movzx eax, word [ebx]
push 0
push 0
push esi
push dword [edi]
push eax
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [case.0xb3c78.0]
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0xb3125
mov dword [ecx - 0xc], esi
mov ecx, dword [edi]
pop edi
mov byte [esi + ecx], 0
pop esi
push 1
pop eax
pushal
popal
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.000b37b0
int3

Function at 0xb7c30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
sub edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0xb7c6c
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0xb7c64
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0xb7c6e
inc edx
add eax, 0x28
cmp edx, ebx
jb 0xb7c54
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xb7d40
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0xb7d54
sub eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0xb7d6f
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x445a3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 0x14], 1
and dword [ebp - 0x10], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
and dword [ebp - 0x44], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
or dword [ebp - 0x18], 0xffffffff
and dword [ebp - 8], 0
mov dword [ebp - 0x40], 0x64616f4c
mov dword [ebp - 0x3c], 0x6f736552
mov dword [ebp - 0x38], 0x65637275
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x40]
push eax
push 0x4082a8
call dword [0x4080dc]
push eax
call dword [0x4080d0]
mov dword [ebp - 8], eax
push 0x4082b8
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call dword [0x4080a4]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [0x4080c4]
mov dword [ebp - 4], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
call dword [0x4080d8]
cmp dword [ebp + 0x10], 0x65
jne 0x445ae2
mov dword [ebp - 0x1c], 0xc6f
cmp dword [ebp + 0x10], 0x66
jne 0x445aef
mov dword [ebp - 0x1c], 0x145
push dword [ebp - 4]
call fcn.0044b95d
pop ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x44]
push dword [ebp - 0x10]
call fcn.0044b94b
add esp, 0xc
push 0
push dword [ebp - 0x1c]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.004455fb
push 0
push dword [ebp + 0x14]
push 2
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [fcn.004080a0]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x445b4c
and dword [ebp - 0x14], 0
jmp 0x445b61
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [fcn.004080bc]
cmp dword [ebp - 0x10], 0
je 0x445b76
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.0044b957
pop ecx
cmp dword [ebp - 0x44], 0
je 0x445b85
push dword [ebp - 0x44]
call dword [0x4080a8]
cmp dword [ebp - 0x18], 0xffffffff
je 0x445b94
push dword [ebp - 0x18]
call dword [fcn.004080e8]
mov eax, dword [ebp - 0x14]
leave
ret 0x10
Function at 0x4472d8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 4], 0xffffffff
cmp dword [0x40cd40], 0
jne 0x447365
push 0x400
call fcn.0044b95d
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x40cd40], eax
and dword [ebp - 8], 0
jmp 0x44730e
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x447365
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 8
jmp 0x44732d
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x447354
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x44734a
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
jmp 0x447352
mov eax, dword [ebp - 0xc]
shr eax, 1
mov dword [ebp - 0xc], eax
jmp 0x447326
mov eax, dword [ebp - 8]
mov ecx, dword [0x40cd40]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edx
jmp 0x447307
and dword [ebp - 0x14], 0
jmp 0x447372
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x4473ae
and dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
movsx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x40cd40]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x44736b
mov eax, dword [ebp - 4]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 8