joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bbb80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4bbba3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4bbbce
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004552c0
add esp, 4
test al, al
jne 0x4bbbe0
xor ebx, ebx
jmp 0x4bbbb7
call fcn.004af950
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.004afa80
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00494230
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4bbc1f
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.0044f100
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4bbc44
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.00494230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x4bbc66
push dword [ebp - 0xc4]
call fcn.0046acdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004afae0
jmp 0x4bbbdc

Function at 0x4bbc80
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4bbca3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4bbcbb
and eax, 0x410
cmp eax, 0x410
je 0x4bbcfb
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4bbcc5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x4bbce9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004552c0
add esp, 4
test al, al
jne 0x4bbd16
xor ebx, ebx
jmp 0x4bbcd2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004bbdb0
call fcn.004af950
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.004afa80
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.00494230
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4bbd58
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0044f100
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4bbd7d
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00494230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x4bbd9f
push dword [ebp - 0xc4]
call fcn.0046acdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004afae0
jmp 0x4bbcf7
Function at 0x4bbdb0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4bbdd2
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x4bbded
push 2
call fcn.004552c0
add esp, 4
test al, al
jne 0x4bbe09
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004af950
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.004afa80
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.00494230
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x4bbe4c
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.0044f100
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4bbe71
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push dword [ebp - 0xc8]
call fcn.00494230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x4bbe98
push dword [ebp - 0xc4]
call fcn.0046acdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004afae0
jmp 0x4bbded
Function at 0x4c2f80
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bbc80
Function at 0x10033320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1003332f
pop dword [ebp - 8]
mov eax, 0x2aa54db8
add eax, 0xe55de577
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xeee820b7
add dword [ebp - 0x18], 0x5f6a2494
mov dword [ebp - 0x14], 0xbbf71a1e
add dword [ebp - 0x14], 0x763c3227
mov dword [ebp - 0x10], 0xb53208ca
sub dword [ebp - 0x10], 0x68e5c49c
mov dword [ebp - 0xc], 0x967117c5
add dword [ebp - 0xc], 0x698ee83b
lea eax, [ebp - 0x18]
push eax
mov eax, 0xec8ce468
add eax, 0x23773bcc
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x19b137de
add dword [ebp - 0x18], 0x5ac13178
mov dword [ebp - 0x14], 0xe2ddc3c4
add dword [ebp - 0x14], 0x5e8e9db1
mov dword [ebp - 0x10], 0x247084f5
add dword [ebp - 0x10], 0x3efee777
mov dword [ebp - 0xc], 0x484ef8f
add dword [ebp - 0xc], 0xfb7b1071
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x41a58
push 0
call eax
mov ecx, 0x3137
mov esi, eax
mov edi, 0x10057e00
add edi, dword [ebp - 8]
mov ebx, 0x802fa28f
sub ebx, 0xe96831ab
xor dword [ebp - 4], 0x3de71912
mov edx, dword [edi]
sub dword [ebp - 4], 0x531706c3
add edx, ebx
add dword [ebp - 4], eax
mov dword [esi], edx
xor dword [ebp - 4], ebx
add esi, 0xcc5a5386
add esi, 0x33a5ac7e
add edi, 0xfff600c2
add edi, 0x9ff42
loop 0x10033440
add eax, 0x80444f51
add eax, 0x7fbc685e
xor ebx, ebx
add ebx, eax
add eax, 0x72e601be
sub eax, 0x72e601b9
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10033320
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.10033320
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10033320
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x10004f5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10004f6b
pop dword [ebp - 0x38]
mov eax, 0xe0e7d724
add eax, 0x2f187847
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x13a3c55c
sub dword [ebp - 0x48], 0xc5518011
mov dword [ebp - 0x44], 0x4e2e37f
sub dword [ebp - 0x44], 0xd2af973a
mov dword [ebp - 0x40], 0xd24eb61d
add dword [ebp - 0x40], 0x79fd8e11
mov dword [ebp - 0x3c], 0x15666e81
sub dword [ebp - 0x3c], 0x15666e81
lea eax, [ebp - 0x48]
push eax
mov eax, 0xce7dcaed
add eax, 0x41830593
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x69bd0fb6
add dword [ebp - 0x48], 0xab559a0
mov dword [ebp - 0x44], 0x75c8119
add dword [ebp - 0x44], 0x3a0fe05c
mov dword [ebp - 0x40], 0x6efb37e9
sub dword [ebp - 0x40], 0xb8bcb7d
mov dword [ebp - 0x3c], 0x162f2d94
add dword [ebp - 0x3c], 0xe9d0d26c
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xc3653613
sub eax, 0xb364659b
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38e15
push 0
call eax
mov ecx, 0xb2616273
add ecx, 0x4d9ee817
mov ebx, eax
mov edi, 0xd3ebd3f7
sub edi, 0xc3ea1ff7
add edi, dword [ebp - 0x38]
mov edx, 0x2b5b4665
sub edx, 0x9b24e771
add dword [ebp - 4], 0x1d799edb
mov esi, dword [edi]
xor dword [ebp - 0x34], edx
sub esi, edx
add dword [ebp - 0x14], esi
mov dword [ebx], esi
add dword [ebp - 0x1c], esi
add ebx, 0x98e067ff
sub ebx, 0x98e067fb
add edi, 4
loop 0x1000508d
add eax, 0xc9b4c215
sub eax, 0xc9b3a51a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9980770d
add ecx, 0x767f88f3
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x10009670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x100096c8
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x100096c8
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10004f5c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x100027b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x30]
lea esi, [ebp - 0x2c]
push ebx
sub esp, 0x2c
mov dword [ebp - 0x30], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x10002820
movzx eax, word [ebp - 0x2c]
test ax, ax
je 0x10002807
mov ebx, dword [sym.imp.ucrtbase.dll_towupper]
mov edi, esi
lea esi, [esi]
nop
movzx eax, ax
add edi, 2
mov dword [esp], eax
call ebx
mov word [edi - 2], ax
movzx eax, word [edi]
test ax, ax
jne 0x100027f0
mov dword [esp], esi
call dword [sym.imp.oleaut32.dll_SysAllocString]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10004f20
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x20
mov dword [ebp - 0x10], eax
movzx ecx, word [edx]
test esi, esi
je 0x10005090
mov eax, dword [ebp + 8]
test eax, eax
je 0x10005000
test cx, cx
je 0x10005080
mov ebx, edx
nop
add ebx, 2
cmp word [ebx], 0
jne 0x10004f50
sub ebx, edx
sar ebx, 1
cmp word [esi], 0
je 0x10004f77
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x10004f68
sub eax, esi
sar eax, 1
add ebx, eax
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x10004f90
add eax, 2
cmp word [eax], 0
jne 0x10004f80
sub eax, dword [ebp + 8]
sar eax, 1
add ebx, eax
add ebx, 0x4a
mov dword [ebp - 0x14], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x14]
test eax, eax
mov edi, eax
je 0x100050fa
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s_AND_Name_s
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._swprintf_2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._exec_query
mov dword [esp], edi
mov ebx, eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x10005090
test cx, cx
je 0x100050e7
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x10005018
sub eax, edx
sar eax, 1
cmp word [esi], 0
je 0x1000503f
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x10005030
sub ecx, esi
sar ecx, 1
add eax, ecx
lea ebx, [eax + 0x3c]
mov dword [ebp - 0x14], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x100050fa
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._swprintf_2
jmp 0x10004fd2
xor ebx, ebx
jmp 0x10004f5d
mov eax, edx
test cx, cx
je 0x100050ee
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x100050a0
sub eax, edx
mov ebx, eax
add eax, 0x58
sar ebx, 1
add ebx, 0x2c
mov dword [ebp - 0x14], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x100050fa
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._swprintf_2
jmp 0x10004fd2
xor eax, eax
jmp 0x10005025
mov eax, 0x58
mov ebx, 0x2c
jmp 0x100050b5
mov ebx, 0x8007000e
jmp 0x10004ff3
Function at 0x10013a50
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov edi, dword [ebp + 8]
mov edx, dword [edi + 8]
mov esi, dword [edi + 4]
test edx, edx
mov dword [ebp - 0x10], edx
je 0x10013ab0
add esi, dword [edi + 0xc]
add esi, 0x1a
lea eax, [esi + esi]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x10013aa2
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x10], edx
mov eax, dword [edi]
mov dword [esp + 8], str.SELECT__FROM__s_WHERE__s
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._swprintf.constprop.0
add esp, 0x18
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + esi + 0x1e]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x10013aa2
xor eax, eax
mov edx, 0x53
jmp 0x10013ad7
movzx edx, word [eax + str.SELECT__FROM]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x10013ad0
cmp word [ebx], 0
mov esi, dword [edi]
mov edx, ebx
je 0x10013af9
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x10013af0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [esi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10013b00
add esp, 0x18
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4241dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x45], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], ecx
cmp eax, 2
ja 0x402248
mov ecx, 2
jmp 0x402263
cmp eax, 8
ja 0x402254
mov ecx, 8
jmp 0x402263
mov ecx, 0xa
cmp ecx, eax
sbb ecx, ecx
and ecx, 6
add ecx, 0xa
cmp dword [ebp + 0x14], 1
push ebx
push esi
push edi
lea esi, [ebp - 0x44]
jbe 0x4022df
mov dword [ebp - 0x44], 0x300030
mov dword [ebp - 0x40], 0x300030
mov dword [ebp - 0x3c], 0x300030
mov dword [ebp - 0x38], 0x300030
mov dword [ebp - 0x34], 0x300030
mov dword [ebp - 0x30], 0x300030
mov dword [ebp - 0x2c], 0x300030
mov dword [ebp - 0x28], 0x300030
mov dword [ebp - 0x24], 0x300030
mov dword [ebp - 0x20], 0x300030
mov dword [ebp - 0x1c], 0x300030
mov dword [ebp - 0x18], 0x300030
mov dword [ebp - 0x14], 0x300030
mov dword [ebp - 0x10], 0x300030
mov dword [ebp - 0xc], 0x300030
mov dword [ebp - 8], 0x300030
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov eax, ebx
xor edx, edx
div ecx
inc edi
lea esi, [esi + 2]
mov ebx, eax
mov ax, word [edx*2 + str.0123456789ABCDEF]
mov word [esi - 2], ax
test ebx, ebx
jne 0x4022e4
mov dword [ebp - 0x4c], edi
mov edi, dword [ebp + 0x14]
cmp dword [ebp - 0x4c], edi
lea ebx, [ebp - 0x44]
cmova edi, dword [ebp - 0x4c]
xor eax, eax
cmp byte [ebp - 0x45], al
lea ebx, [ebx + edi*2]
setne al
lea esi, [eax + edi]
lea eax, [esi*2 + 0xd]
and eax, 0xfffffff8
add eax, 8
push eax
call fcn.0040e59c
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], esi
mov dword [eax + 8], 0x402150
mov dword [eax], 1
add esp, 4
cmp byte [ebp - 0x45], 0
mov dword [ecx], eax
mov dword [ecx + 4], 0
lea ecx, [eax + 0xc]
je 0x402364
mov eax, 0x2d
mov word [ecx], ax
add ecx, 2
test edi, edi
je 0x402380
jmp 0x402370
mov ax, word [ebx - 2]
lea ebx, [ebx - 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
dec edi
jne 0x402370
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e615
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4034c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4188b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
mov eax, dword [0x4241dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00402110
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4035a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4035a5
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401000
push 0
push 0x41a47c
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00401ef0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00402170
test eax, eax
lea ecx, [ebp - 0x20]
sete bl
mov byte [ebp - 4], 1
call fcn.004010d0
test bl, bl
jne 0x403596
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00401000
call fcn.004034c0
add esp, 8
test al, al
je 0x403596
push 0
lea ecx, [ebp + 8]
call fcn.00402110
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
lea ecx, [ebp - 0x18]
setne bl
mov byte [ebp - 4], 0
call fcn.004010d0
jmp 0x4035a7
xor bl, bl
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.004010d0
jmp 0x4035a7
mov bl, 1
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret