joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x10001cd0
Capabilities:
Encode data using xor

Disassembly:
js 0x10001cdf
add edx, 0xa6a70f44
test bl, dh
mov eax, 0x30fbea8f
bswap edx
lea ebp, [0xfffffa21]
mov edx, 0x1ad9a7b0
add ebp, 0x950
bswap ecx
mov bl, 0x6f
xor eax, esi
sub ebp, 0xd94
add ebp, 0xd93
add ebx, edi
bswap eax
imul eax, ebp
cmp ebp, 0x159
jae 0x10001cf3
dec ebp
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x41ff11
pop dword [ebp - 0x40]
mov eax, 0x41ff11
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x474cd890
sub dword [ebp - 0x50], 0xf8fa9345
mov dword [ebp - 0x4c], 0xca9aa1fc
sub dword [ebp - 0x4c], 0x986755b7
mov dword [ebp - 0x48], 0x94f531bb
sub dword [ebp - 0x48], 0x48a8ed8d
mov dword [ebp - 0x44], 0x7505f7cd
add dword [ebp - 0x44], 0x8afa0833
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xeb355b2b
sub dword [ebp - 0x50], 0x76c2f1d5
mov dword [ebp - 0x4c], 0xcd428563
sub dword [ebp - 0x4c], 0x8bd623ee
mov dword [ebp - 0x48], 0x519a7ce2
add dword [ebp - 0x48], 0x11d4ef8a
mov dword [ebp - 0x44], 0xbcdafda
add dword [ebp - 0x44], 0xf4325026
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x43a5b7ce
add eax, 0xbc9c7956
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3d297
push 0
call eax
mov ecx, 0x45ce
mov edx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x40]
mov ebx, 0x8aa52fd2
add dword [ebp - 0x2c], ebx
mov edi, dword [esi]
xor edi, ebx
xor dword [ebp - 0x24], eax
mov dword [edx], edi
add dword [ebp - 0xc], edx
add edx, 0xd694f44e
sub edx, 0xd694f44a
add esi, 4
loop 0x420017
add eax, 0x7f677440
sub eax, 0x7f666a35
mov ebx, eax
add eax, 0x728fe8e1
add eax, 0x8d701724
mov ecx, 0x74440599
sub ecx, 0x74040599
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x432d70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a81a8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x65b0c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor bl, bl
mov esi, str._nosurvey__uninstall__skipuninstallwebpage
test dl, dl
mov eax, str._nosurvey__uninstall
cmove esi, eax
mov dword [ebp - 4], 0
call fcn.004046a0
mov ecx, eax
test ecx, ecx
je 0x432f10
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [0x6643c8]
push str.running_the_uninstaller_at__s_with_parameters__s_and_wait_for_it_to_exit...
push eax
call fcn.00420480
push dword [ebp - 0x14]
mov edx, 0x18a
mov ecx, 0x63ed78
call fcn.0042bb40
mov eax, dword [0x6643c8]
add esp, 0x14
mov dword [ebp - 0x40], eax
xorps xmm0, xmm0
mov eax, dword [0x6643bc]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x50]
push eax
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0x63bde8
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x432ea5
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi]
lea eax, [ebp - 0x14]
push str....the_uninstaller_exited_with_exit_code__d
push eax
call fcn.00420480
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov edx, 0x19c
mov ecx, 0x63ed78
push esi
call fcn.0042bb40
mov bl, 1
jmp 0x432ed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push str...._unable_to_run_the_uninstaller__ShellExecuteEx___failed_with_error_code__u
push eax
call fcn.00420480
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov edx, 0x1a2
mov ecx, 0x63ed78
push esi
call fcn.0042bb40
add esp, 4
add esi, 0xfffffff0
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x432ef2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057374d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004043d0
int3
Function at 0x445b00
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a95d8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x65b0c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], edi
push ecx
mov ecx, 5
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.004301a0
add esp, 4
test al, al
jne 0x445c25
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
sub esp, 8
movq qword [ebp - 0x68], xmm0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x58], xmm0
movups xmmword [ebp - 0x48], xmm0
call fcn.004463f0
mov ecx, dword [ebp - 0x64]
mov eax, 0x1948b0fd
mov esi, dword [ebp - 0x68]
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x288
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x445c1b
mov esi, dword [ebp - 0x68]
or eax, 0xffffffff
cmp dword [esi + 0x19c], eax
jae 0x445c09
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push 0x644f40
lea eax, [ebp - 0x58]
push 0x12
push eax
call fcn.00444aa0
mov eax, dword [esi + 0x19c]
add esp, 0x24
mov esi, dword [esi]
test esi, esi
jne 0x445bb8
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x34]
call fcn.00444a50
lea ecx, [ebp - 0x68]
call fcn.00446460
jmp 0x445c6c
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x445c4c
cmp esi, 1
je 0x445c4c
cmp esi, 0x80010106
jne 0x445c56
push ecx
lea eax, [ebp - 0x34]
push eax
call fcn.00445cc0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x445c66
cmp esi, 1
jne 0x445c6c
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x34]
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445c85
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00419250
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057374d
mov esp, ebp
pop ebp
ret 4
Function at 0x464970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573cce
mov edi, eax
add esp, 4
test edi, edi
je 0x4649bc
push 1
mov dword [ebp - 4], 0
call fcn.005714fd
add esp, 4
mov dword [edi + 4], eax
jmp 0x4649be
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov ecx, 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp + 0xc]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, 0x48
mov dword [esi + 0x40], edx
and edx, 1
mov dword [esi], vtable.Poco::Base64EncoderBuf.0
cmovne eax, ecx
mov dword [esi + 0x48], 0
mov ecx, dword [ebp + 8]
test edx, edx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__tld
mov dword [esi + 0x54], eax
mov eax, 0x5b1750
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x46eaa0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x46eab0
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
push 0x288
mov dword [esp + 0xc], 0x288
mov dword [edi], eax
mov word [edi + 4], ax
call fcn.00574000
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x46eafd
push esi
call fcn.00573cbd
push dword [esp + 0xc]
call fcn.00574000
add esp, 8
mov esi, eax
jmp 0x46eb01
test eax, eax
jne 0x46eb5a
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x46eb51
xor dl, dl
mov eax, esi
test esi, esi
je 0x46eb51
nop dword [eax]
test dl, dl
jne 0x46eb51
cmp dword [eax + 0x1a0], 6
jne 0x46eb4b
cmp dword [eax + 0x190], 6
jne 0x46eb4b
mov ecx, dword [eax + 0x194]
mov dl, 1
mov dword [edi], ecx
mov cx, word [eax + 0x198]
mov word [edi + 4], cx
mov eax, dword [eax]
test eax, eax
jne 0x46eb20
push esi
call fcn.00573cbd
add esp, 4
pop edi
pop esi
pop ecx
ret
Function at 0x46fdd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab554
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0046e730
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::Crypto::CipherKeyImpl.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040a1b0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ebx, [esi + 0x34]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.0046f9e0
mov byte [ebp - 4], 4
call fcn.0046fd50
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x46fe6a
mov eax, dword [edi]
push eax
call fcn.004b52b0
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x46ff5e
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x14], 0x10
jb 0x46fe89
mov eax, dword [eax]
push eax
call fcn.004b52e0
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x46ffa0
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00470230
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443a50
mov edi, eax
lea ecx, [esi + 0x28]
cmp ecx, edi
je 0x46fee4
call fcn.00438910
mov ecx, dword [edi]
mov dword [esi + 0x28], ecx
mov eax, dword [edi + 4]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00438910
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00470220
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443a50
mov edi, eax
cmp ebx, edi
je 0x46ff31
mov ecx, ebx
call fcn.00438910
mov ecx, dword [edi]
mov dword [ebx], ecx
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00438910
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00470100
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
push edi
lea eax, [ebp - 0x28]
push str.Cipher
push eax
call fcn.0040f1a0
push 0x5c8de8
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
call fcn.00442a00
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.0045b650
push 0x651aa8
lea eax, [ebp - 0x6c]
push eax
call fcn.005763d7
push edi
lea eax, [ebp - 0x40]
push str.Digest
push eax
call fcn.0040f1a0
push 0x5c8de8
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call fcn.00442a00
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.0045b650
push 0x651aa8
lea eax, [ebp - 0x6c]
push eax
call fcn.005763d7
int3
Function at 0x4d3970
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4d3997
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4d3986
pop edi
movzx eax, dl
pop esi
ret

Function at 0x596925
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005965cc

Function at 0x596930
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00596756

Function at 0x5a3b00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573cce
mov edi, eax
add esp, 4
test edi, edi
je 0x5a3b4c
push 1
mov dword [ebp - 4], 0
call fcn.005714fd
add esp, 4
mov dword [edi + 4], eax
jmp 0x5a3b4e
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov dword [esi], vtable.Poco::HexBinaryEncoderBuf.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0x48
mov dword [esi + 0x48], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x4c], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4017f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418b78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x421018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 4], ebx
xor eax, eax
cmp dword [ebp + 0x20], 0x10
mov ecx, 0x2a
lea esi, [ebp - 0x1d0]
lea edi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x98], 0x6a09e667
mov dword [ebp - 0x94], 0xbb67ae85
mov dword [ebp - 0x90], 0x3c6ef372
mov dword [ebp - 0x8c], 0xa54ff53a
mov dword [ebp - 0x88], 0x510e527f
mov dword [ebp - 0x84], 0x9b05688c
mov dword [ebp - 0x80], 0x1f83d9ab
mov dword [ebp - 0x7c], 0x5be0cd19
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
jae 0x4018c1
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x1c]
lea esi, [ebp - 0x120]
call fcn.00401570
lea edi, [ebp - 0x30]
call fcn.00401620
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov byte [ebp - 0x38], 0
xor esi, esi
lea edi, [ebp - 0x78]
jmp 0x4018f0
movzx ecx, byte [ebp + esi - 0x30]
push ecx
push str._02x
push edi
call ebx
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x20
jb 0x4018f0
mov edi, dword [ebp - 0x124]
lea eax, [ebp - 0x78]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401927
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x78]
mov ecx, edi
call fcn.00401d00
cmp dword [ebp + 0x20], 0x10
jb 0x40194f
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417d4a
mov esp, ebp
pop ebp
ret
Function at 0x403240
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, eax
movzx eax, word [esi + 4]
mov ecx, dword [esi + 6]
mov edx, dword [esi + 0xa]
add esi, 6
mov dword [ebp - 0x1e], ecx
mov cl, byte [esi + 0xa]
push edi
mov word [ebp - 0x20], ax
movzx eax, word [esi + 8]
mov byte [ebp - 0x14], cl
push esi
push str.SELECT__FROM_CashShopData_WHERE_AccountID_s
mov ecx, 0x4ed8c0
mov dword [ebp - 0x24], 0x1820c1
mov dword [ebp - 0x1a], edx
mov word [ebp - 0x16], ax
mov byte [ebp - 0x13], 0
call fcn.00414e40
add esp, 8
test al, al
je 0x4032ee
mov edx, dword [0x4ed8cc]
push edx
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x4032ee
push str.WCoinC
mov ebx, 0x4ed8c0
call fcn.00415000
push str.WCoinP
mov dword [ebp - 0x10], eax
call fcn.00415000
push str.GoblinPoint
mov dword [ebp - 0xc], eax
call fcn.00415000
mov dword [ebp - 8], eax
mov eax, dword [0x4ed8cc]
push eax
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
mov ecx, dword [0x4ed8cc]
push 2
push ecx
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x40335c
mov edx, dword [0x4ed8cc]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push edx
call edi
mov eax, dword [0x4ed8cc]
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push eax
call ebx
push esi
push str.INSERT_INTO_CashShopData__AccountID_WCoinC_WCoinP_GoblinPoint__VALUES___s_0_0_0_
mov ecx, 0x4ed8c0
call fcn.00414e40
add esp, 8
test al, al
jne 0x40333e
mov ecx, dword [0x4ed8cc]
push ecx
call edi
mov edx, dword [0x4ed8cc]
push 2
push edx
call ebx
mov byte [ebp - 0x13], 1
jmp 0x40335c
mov eax, dword [0x4ed8cc]
push eax
call edi
mov ecx, dword [0x4ed8cc]
push 2
push ecx
call ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x24]
push edx
push eax
mov ebx, 0x20
call fcn.00416c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4