joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x414e28
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x104
call fcn.0040406c
push 0xffffffffffffffff
movzx eax, word [ebp - 2]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403f8c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
jne 0x414e00
lea eax, [ebp - 0xc]
call fcn.00403af0
mov eax, dword [ebp - 0xc]
call fcn.00403f8c
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00403ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414e2f
lea eax, [ebp - 0xc]
call fcn.00403af0
ret

Function at 0x414f00
Capabilities:
Get session user name
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41508a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403af0
lea eax, [ebp - 8]
call fcn.00414e34
mov eax, dword [ebp - 8]
call fcn.00407230
test al, al
je 0x41505c
lea eax, [ebp - 0x115]
mov edx, 0x104
call fcn.00405b14
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x115]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00403d60
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00406c1c
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x125]
call fcn.004134b4
mov eax, 0x4183f4
call fcn.00403fdc
mov byte [eax], 0x43
push dword [0x4183f4]
push 0x4150a0
push 0x4150b8
lea edx, [ebp - 0x138]
lea eax, [ebp - 0x125]
call fcn.00413528
push dword [ebp - 0x138]
push 0x4150c4
lea eax, [ebp - 0x134]
mov edx, 5
call fcn.00403e4c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x10]
call fcn.00406b0c
push dword [ebp - 8]
push 0x4150d0
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403e4c
mov eax, dword [ebp - 8]
call fcn.00407230
test al, al
jne 0x415035
mov eax, dword [ebp - 8]
call fcn.00407538
mov eax, dword [ebp - 8]
call fcn.00414b34
test eax, eax
je 0x41505c
push 2
mov eax, dword [ebp - 8]
call fcn.00403f8c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415091
lea eax, [ebp - 0x138]
mov edx, 4
call fcn.00403b14
lea eax, [ebp - 0x10]
call fcn.00403af0
lea eax, [ebp - 8]
call fcn.00403af0
ret

Function at 0x415224
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0x32
jle 0x415248
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CopyFileA
mov esp, ebp
pop ebp
ret
Function at 0x415598
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
xor ecx, ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f7c
mov eax, dword [ebp - 8]
call fcn.00403f7c
lea eax, [ebp - 0x168]
mov edx, dword [0x405e84]
call fcn.0040438c
xor eax, eax
push ebp
push 0x41574b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.00407230
test al, al
je 0x41570f
mov eax, dword [ebp - 8]
call fcn.00407230
test al, al
je 0x41570f
lea eax, [ebp - 0x16c]
mov ecx, 0x415764
mov edx, dword [ebp - 8]
call fcn.00403dd8
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
or edx, 0xffffffff
call fcn.004072b8
test eax, eax
jne 0x415708
mov eax, dword [ebp - 0x160]
and eax, 0x10
cmp eax, 0x10
je 0x4156ea
push dword [ebp - 8]
push 0x415774
push dword [ebp - 0x15c]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00403e4c
mov eax, dword [ebp - 0x170]
call fcn.004150d4
test eax, eax
je 0x4156ea
push 0
push dword [ebp - 4]
push 0x415774
push dword [ebp - 0x15c]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00403e4c
mov eax, dword [ebp - 0x174]
call fcn.00403f8c
push eax
push dword [ebp - 8]
push 0x415774
push dword [ebp - 0x15c]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00403e4c
mov eax, dword [ebp - 0x178]
call fcn.00403f8c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4156ea
inc dword [ebp - 0x10]
lea eax, [ebp - 0x168]
call fcn.00407308
test eax, eax
je 0x415649
lea eax, [ebp - 0x168]
call fcn.0040732c
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415752
lea eax, [ebp - 0x178]
mov edx, 4
call fcn.00403b14
lea eax, [ebp - 0x168]
mov edx, dword [0x405e84]
call fcn.00404450
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b14
ret
Function at 0x415a2c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
xor edx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f7c
lea eax, [ebp - 0x164]
mov edx, dword [0x405e84]
call fcn.0040438c
xor eax, eax
push ebp
push 0x415bc5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00407230
test al, al
je 0x415b8e
lea eax, [ebp - 0x168]
mov ecx, 0x415bdc
mov edx, dword [ebp - 4]
call fcn.00403dd8
mov eax, dword [ebp - 0x168]
lea ecx, [ebp - 0x164]
or edx, 0xffffffff
call fcn.004072b8
test eax, eax
jne 0x415b61
mov eax, dword [ebp - 0x158]
mov edx, 0x415bec
call fcn.00403ed8
je 0x415b43
mov eax, dword [ebp - 0x158]
mov edx, 0x415bf8
call fcn.00403ed8
je 0x415b43
push dword [ebp - 4]
push 0x415c04
push dword [ebp - 0x158]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00403e4c
mov eax, dword [ebp - 0x16c]
call fcn.00403f8c
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 0xfffffffe
push eax
push dword [ebp - 4]
push 0x415c04
push dword [ebp - 0x158]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00403e4c
mov eax, dword [ebp - 0x170]
call fcn.00403f8c
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x164]
call fcn.00407308
test eax, eax
je 0x415ab7
lea eax, [ebp - 0x164]
call fcn.0040732c
mov eax, dword [ebp - 4]
call fcn.00403f8c
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 0xfffffffe
push eax
mov eax, dword [ebp - 4]
call fcn.00403f8c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415bcc
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00403b14
lea eax, [ebp - 0x164]
mov edx, dword [0x405e84]
call fcn.00404450
lea eax, [ebp - 4]
call fcn.00403af0
ret

Function at 0x415c54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x415c90
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor dword [edx], eax
add dword [ebp - 4], 4
add dword [ebp - 8], 4
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x415c76
mov esp, ebp
pop ebp
ret
Function at 0x415c94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
and eax, 3
test eax, eax
jne 0x415cc0
mov ecx, dword [ebp - 0xc]
shr ecx, 2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00415c54
jmp 0x415ceb
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x415ceb
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebp - 4]
xor byte [edx], al
inc dword [ebp - 4]
inc dword [ebp - 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x415cd3
mov esp, ebp
pop ebp
ret
Function at 0x417568
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x417570
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x417742
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403af0
mov eax, dword [ebp - 8]
call fcn.00403af0
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.004028dc
cmp dword [ebp - 0x10], 0
je 0x41771a
lea eax, [ebp - 0xc]
call fcn.00403af0
mov eax, dword [ebp - 0x10]
call fcn.00403d8c
mov esi, eax
test esi, esi
jle 0x4175f6
mov edi, 1
mov eax, dword [ebp - 0x10]
mov bl, byte [eax + edi - 1]
cmp bl, 0x2c
je 0x4175f6
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403cd8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00403d94
inc edi
dec esi
jne 0x4175d1
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00406cd8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00403b88
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00403b44
mov eax, dword [ebp - 0xc]
call fcn.00403d8c
mov edx, eax
sub edx, 4
lea eax, [ebp - 0xc]
call fcn.0040406c
mov eax, dword [ebp - 0xc]
call fcn.00407220
test al, al
je 0x41771a
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0040709c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41771a
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
test esi, esi
jne 0x41766b
mov eax, ebx
call fcn.004071b0
jmp 0x41771a
mov eax, esi
call fcn.00402628
mov edi, eax
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.00407120
mov eax, ebx
call fcn.004071b0
push 0x418404
call fcn.00417488
push esi
push edi
call fcn.00417474
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.00407680
mov eax, dword [ebp - 0x18]
call fcn.00403d8c
mov esi, eax
test esi, esi
jle 0x4176d3
mov edi, 1
mov eax, dword [ebp - 0x18]
cmp byte [eax + edi - 1], 0xd
jne 0x4176cf
mov eax, dword [ebp - 0x18]
cmp byte [eax + edi], 0xa
jne 0x4176cf
lea eax, [edi + 2]
mov dword [ebp - 0x14], eax
jmp 0x4176d3
inc edi
dec esi
jne 0x4176b4
mov eax, dword [ebp - 8]
call fcn.00403af0
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00403d8c
mov esi, eax
sub esi, edi
jl 0x41771a
inc esi
mov eax, dword [ebp - 0x18]
mov bl, byte [eax + edi - 1]
cmp bl, 0xa
je 0x41771a
cmp bl, 0xd
je 0x41771a
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00403cd8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00403d94
mov eax, dword [ebp - 8]
inc edi
dec esi
jne 0x4176ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417749
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00403b14
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403b14
ret
Function at 0x40e01870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e01390
push 0x40e01a70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x40e020a8], 0xffffffff
mov dword [0x40e020ac], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40e020a4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x40e020a0]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x40e020b0], ecx
call fcn.40e01a60
mov eax, dword [0x40e02014]
test eax, eax
jne 0x40e01901
push 0x40e01a50
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.40e01a30
push 0x40e0200c
push 0x40e02008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x40e0209c]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x40e02098]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x40e02004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40e01a0f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40e01975
cmp al, 0x22
jne 0x40e01967
cmp byte [esi], 0x22
jne 0x40e0197e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40e0198e
cmp al, 0x20
ja 0x40e0198e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40e0197e
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40e019af
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40e019b4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x40e019f4
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40e0197e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40e01a0f
Function at 0x1001e8a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1001e8cc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001e8ee
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1001e8f0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1001e975
jg 0x1001e905
test esi, esi
je 0x1001e975
test ecx, ecx
jl 0x1001e94e
jg 0x1001e90f
test eax, eax
je 0x1001e94e
cmp edi, ecx
jg 0x1001e923
jl 0x1001e919
cmp esi, eax
jae 0x1001e923
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1001e951
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1001e975
jg 0x1001e95b
test esi, esi
je 0x1001e975
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1001e975
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001e990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1001e9bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001e9de
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1001e9e0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x1001ea80
jg 0x1001e9fd
test esi, esi
je 0x1001ea80
test ecx, ecx
jl 0x1001ea4a
jg 0x1001ea07
test eax, eax
je 0x1001ea4a
cmp ebx, ecx
jg 0x1001ea1b
jl 0x1001ea11
cmp esi, eax
jae 0x1001ea1b
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x1001ea51
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x1001ea80
jg 0x1001ea5b
test esi, esi
je 0x1001ea80
cmp dword [edi + 0x4c], 0
je 0x1001ea80
mov ecx, edi
call fcn.1001f2a0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001edf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10224008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001ee20
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001ee50
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001ee50
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001ef25
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001ee79
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001ee85
movsx eax, bl
jmp 0x1001eebc
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1001ef25
cmp eax, 1
jle 0x1001eee6
cmp eax, 3
jne 0x1001ef25
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001ef04
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001ef25
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001ef25
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10224008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1001f3b3
cmp byte [esi + 0x3d], 0
je 0x1001f3b3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001f368
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1001f37a
sub eax, 1
je 0x1001f37e
sub eax, 2
je 0x1001f3b3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001f39c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001f368
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret
Function at 0x10026f40
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a8d00
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10224008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 4]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x100270ce
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
test al, al
je 0x100270ce
push 0x40
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x38]
push str.SELECT_soft_id__exe_name_FROM_sem_soft_install_WHERE_soft_id___
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
call fcn.100055f0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], vtable.RC::RCSqliteStmtIF.0
mov dword [ebp - 0x18], vtable.RC::RCSqliteStmt.0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x18]
mov ecx, dword [edi + 4]
push edx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
jne 0x1002709e
push dword [ebp + 8]
push 1
push dword [ebp - 0x14]
call fcn.10111630
xorps xmm0, xmm0
add esp, 0xc
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], vtable.RC::RCResultSetIF.0
mov dword [ebp - 0x20], vtable.RC::RCResultSet.0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x20]
mov ecx, dword [edi + 4]
push edx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, eax
test esi, esi
je 0x1002704a
lea ecx, [ebp - 0x18]
call fcn.10033000
jmp 0x10027093
lea ecx, [ebp - 0x20]
call fcn.100330d0
test al, al
je 0x10027089
push 0
lea ecx, [ebp - 0x20]
call fcn.10033100
mov dword [ebx], eax
lea ecx, [ebp - 0x20]
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.10033130
mov byte [ebp - 4], 3
lea ecx, [ebx + 4]
push eax
call fcn.10004f50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.10005540
lea ecx, [ebp - 0x18]
call fcn.10033000
xor esi, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], vtable.RC::RCResultSet.0
mov byte [ebp - 4], 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], vtable.RC::RCSqliteStmt.0
call fcn.1010f010
add esp, 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10005540
mov eax, esi
jmp 0x100270d3
mov eax, 0xc0011141
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019e7b8
mov esp, ebp
pop ebp
ret 8