joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045070
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100c66d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10047b9b
and dword [ebp - 0x14], 0
cmp dword [0x100c8eb8], 0
mov dword [ebp - 0x18], eax
jne 0x10045123
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100451cb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100451cb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100c8eb8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100c8ebc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100c8ec0], eax
call edi
push eax
call esi
mov dword [0x100c8ec8], eax
test eax, eax
je 0x10045123
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100c8ec4], eax
mov eax, dword [0x100c8ec4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1004517c
cmp dword [0x100c8ec8], ecx
je 0x1004517c
push eax
call esi
push dword [0x100c8ec8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1004517c
test ebx, ebx
je 0x1004517c
call edi
test eax, eax
je 0x10045173
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10045173
test byte [ebp - 8], 1
jne 0x1004517c
or dword [ebp + 0x10], 0x200000
jmp 0x100451af
mov eax, dword [0x100c8ebc]
cmp eax, dword [ebp - 0x18]
je 0x100451af
push eax
call esi
test eax, eax
je 0x100451af
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100451af
mov eax, dword [0x100c8ec0]
cmp eax, dword [ebp - 0x18]
je 0x100451af
push eax
call esi
test eax, eax
je 0x100451af
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100c8eb8]
call esi
test eax, eax
je 0x100451cb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100451cd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c5b5
leave
ret
Function at 0x10062450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call fcn.10062320
mov edi, eax
mov dword [ebp - 4], 0
test edi, edi
je 0x100624b6
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x1006249f
jmp 0x10062480
mov eax, dword [ebp - 4]
mov ecx, eax
inc eax
mov dword [ebp - 4], eax
cmp ecx, 3
jge 0x1006249f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call ebx
mov esi, eax
test esi, esi
je 0x10062480
push edi
call fcn.10054130
add esp, 4
neg esi
pop edi
sbb eax, eax
pop esi
and eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x100624e4
mov eax, dword [ebp - 4]
mov edx, eax
inc eax
mov dword [ebp - 4], eax
cmp edx, 3
jge 0x100624e4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call edi
mov esi, eax
test esi, esi
je 0x100624c5
neg esi
pop edi
sbb eax, eax
pop esi
and eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10062500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
call fcn.10062320
mov esi, eax
test esi, esi
je 0x10062535
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push esi
mov edi, ecx
call fcn.10054130
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
pop esi
pop ebx
mov eax, edx
pop ebp
ret
Function at 0x10062550
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
mov eax, dword [0x100c66d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c9758]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x10062590
push 0x118
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.1009fe00
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x1006261d
mov eax, dword [0x100c9754]
test eax, eax
jne 0x100625c2
lea ecx, [ebp - 0x4bc]
push ecx
mov dword [ebp - 0x4bc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x4ac], 2
sete al
inc eax
mov dword [0x100c9754], eax
cmp eax, 2
jne 0x1006260b
lea edx, [ebp - 0x3a8]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [ebp - 0x3a8]
call fcn.100623f0
mov esi, eax
test esi, esi
je 0x1006261d
push 0x118
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.1009fe00
push esi
mov byte [ebp - 0x24], 0
call fcn.10054130
add esp, 0x10
jmp 0x1006261d
lea ecx, [ebp - 0x13c]
push ecx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10062626
sub eax, edx
test eax, eax
jle 0x1006264c
lea ecx, [ebp - 0x13c]
lea esp, [esp]
cmp byte [ecx + eax - 1], 0x5c
jne 0x1006264c
dec eax
test eax, eax
jg 0x10062640
mov byte [ebp + eax - 0x13c], 0
lea edx, [ebp - 0x13c]
push edx
push str._s_sqlite_
push edi
call fcn.1003df39
mov esi, edi
add esp, 0xc
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x10062670
sub esi, ecx
lea eax, [edi + esi]
push eax
push 0xf
call fcn.1007d6e0
add esp, 8
mov ecx, 3
lea esp, [esp]
movzx eax, byte [edi + esi]
xor edx, edx
mov ebx, 0x3e
div ebx
movzx eax, byte [edi + esi + 1]
add esi, 5
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 5], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 4], al
movzx eax, byte [edi + esi - 3]
xor edx, edx
div ebx
movzx eax, byte [edi + esi - 2]
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 3], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 2], al
movzx eax, byte [edi + esi - 1]
xor edx, edx
div ebx
dec ecx
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], dl
jne 0x10062690
mov ebx, edi
mov byte [edi + esi], cl
call fcn.10062320
mov esi, eax
test esi, esi
je 0x10062728
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
push esi
setne bl
call fcn.10054130
add esp, 4
jmp 0x10062737
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
test ebx, ebx
jne 0x10062654
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1003c5b5
mov esp, ebp
pop ebp
ret
Function at 0x10062ac0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100c66d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10062aec
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c5b5
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100c9754]
test eax, eax
jne 0x10062b1e
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x108], 2
sete al
inc eax
mov dword [0x100c9754], eax
cmp eax, 2
je 0x10062b38
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10062b28
sub eax, edx
cmp eax, 0x104
ja 0x10062adb
push esi
call fcn.10062320
mov esi, eax
test esi, esi
je 0x10062b58
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call fcn.10054130
add esp, 4
jmp 0x10062b61
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
pop esi
cmp ebx, 0xffffffff
je 0x10062adb
mov ecx, dword [ebp - 4]
and bl, 0x10
xor eax, eax
cmp bl, 0x10
sete al
xor ecx, ebp
pop ebx
call fcn.1003c5b5
mov esp, ebp
pop ebp
ret

Function at 0x10062f80
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100c9760], 0
push esi
jne 0x10062fbb
mov esi, 1
add dword [0x100c975c], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x100c975c], esi
mov dword [0x100c974c], eax
cmp eax, 0xffffffff
jne 0x10062fb3
xor eax, eax
pop esi
pop ebp
ret
mov dword [0x100c9760], esi
jmp 0x10062fc0
mov eax, dword [0x100c974c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x1006300f
test esi, esi
jne 0x10063053
push 0x14
call fcn.1003ec0b
mov esi, eax
add esp, 4
test esi, esi
je 0x10063053
mov eax, dword [0x100af7e0]
mov dword [esi], eax
mov ecx, dword [0x100af7e4]
mov eax, dword [0x100c974c]
mov dword [esi + 4], ecx
mov edx, dword [0x100af7e8]
push esi
push eax
mov dword [esi + 8], edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
pop ebp
ret
test esi, esi
je 0x10063053
test eax, eax
jns 0x10063053
mov eax, 0x100af7e0
mov edx, esi
mov ecx, 0xc
sub edx, eax
push edi
mov edi, dword [edx + eax]
cmp edi, dword [eax]
jne 0x10063052
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x10063026
push esi
call fcn.1003cba1
mov ecx, dword [0x100c974c]
add esp, 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10071460
Capabilities:
Encode data using xor
Encrypt data using xxtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 8], esi
cmp edi, 1
jle 0x10071555
mov eax, 0x34
cdq
idiv edi
mov esi, dword [ecx + edi*4 - 4]
add eax, 6
test eax, eax
jle 0x1007154c
dec eax
sub ebx, 0x61c88647
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, 2
and eax, 3
dec edi
xor edx, edx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], eax
test edi, edi
jle 0x10071500
mov eax, dword [ecx + edx*4 + 4]
mov ebx, eax
mov dword [ebp - 8], eax
add eax, eax
mov edi, esi
shr ebx, 3
add eax, eax
shl edi, 4
xor edi, ebx
mov ebx, esi
shr ebx, 5
xor ebx, eax
mov eax, edx
and eax, 3
xor eax, dword [ebp - 4]
add edi, ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx + eax*4]
xor eax, esi
mov esi, dword [ebp + 8]
xor esi, dword [ebp - 8]
inc edx
add eax, esi
xor edi, eax
add dword [ecx + edx*4 - 4], edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx + edx*4 - 4]
dec eax
cmp edx, eax
jl 0x100714b5
mov eax, dword [ecx]
mov ebx, eax
shr ebx, 3
mov edi, esi
shl edi, 4
xor edi, ebx
add eax, eax
add eax, eax
mov ebx, esi
and edx, 3
xor edx, dword [ebp - 4]
shr ebx, 5
xor ebx, eax
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + edx*4]
add edi, ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor eax, dword [ecx]
xor edx, esi
add edx, eax
xor edi, edx
mov eax, edi
mov edi, dword [ebp + 0xc]
add dword [ecx + edi*4 - 4], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [ecx + edi*4 - 4]
test eax, eax
jg 0x10071496
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
jge 0x10071638
mov eax, 0x34
cdq
neg edi
idiv edi
mov dword [ebp + 0xc], edi
add eax, 6
imul eax, eax, 0x9e3779b9
mov dword [ebp + 8], eax
test eax, eax
je 0x1007162f
jmp 0x10071584
mov edi, dword [ebp + 0xc]
shr eax, 2
and eax, 3
lea edx, [edi - 1]
mov dword [ebp - 4], eax
test edx, edx
jle 0x100715de
mov edi, dword [ecx + edx*4 - 4]
mov ebx, esi
shr ebx, 3
add esi, esi
mov eax, edi
shl eax, 4
xor eax, ebx
add esi, esi
mov ebx, edi
shr ebx, 5
xor ebx, esi
mov esi, edx
and esi, 3
xor esi, dword [ebp - 4]
add eax, ebx
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebx + esi*4]
xor esi, edi
mov edi, dword [ebp + 8]
xor edi, dword [ebp - 8]
dec edx
add esi, edi
xor eax, esi
sub dword [ecx + edx*4 + 4], eax
mov esi, dword [ecx + edx*4 + 4]
mov dword [ebp - 8], esi
test edx, edx
jg 0x10071594
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx + edi*4 - 4]
mov ebx, eax
shl ebx, 4
mov edi, esi
shr edi, 3
xor edi, ebx
shr eax, 5
lea ebx, [esi*4]
xor eax, ebx
and edx, 3
xor edx, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 0xc]
xor edx, dword [ecx + eax*4 - 4]
mov eax, dword [ebp + 8]
mov ebx, eax
xor ebx, esi
add edx, ebx
xor edi, edx
sub dword [ecx], edi
mov esi, dword [ecx]
add eax, 0x61c88647
mov dword [ebp - 8], esi
mov dword [ebp + 8], eax
jne 0x10071581
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100728b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, eax
cmp byte [esi + 0xb], 0
jne 0x100729d0
mov eax, dword [esi + 0x74]
push ebx
xor ebx, ebx
push edi
cmp eax, ebx
je 0x100728e2
jmp 0x100728d0
mov edi, dword [eax + 0x18]
push eax
call fcn.10054130
add esp, 4
mov eax, edi
cmp edi, ebx
jne 0x100728d0
mov eax, dword [esi + 0xc0]
push eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0xbc], ebx
call fcn.10054130
mov cl, byte [esi + 0xa]
add esp, 4
mov dword [esi + 0x34], ebx
mov dword [esi + 0xc0], ebx
cmp cl, 2
jb 0x100729b3
cmp byte [esi + 0x11], bl
je 0x100729d2
mov edi, dword [esi + 0x74]
cmp edi, ebx
je 0x10072996
cmp byte [edi + 0x26], 0
je 0x1007298f
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
add ecx, eax
lea ebx, [ecx + edi + 0x38]
mov ecx, dword [ebx]
test ecx, ecx
je 0x1007294e
push eax
push ecx
lea edx, [edi + 0x38]
push edx
call fcn.1003fe30
add esp, 0xc
mov eax, dword [ebx]
push eax
call fcn.10054130
mov ecx, dword [ebx + 4]
push ecx
call fcn.10054130
xor ecx, ecx
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov byte [edi + 0x26], cl
mov word [edi + 0x24], cx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov eax, dword [esi + 0xb0]
add esp, 8
cmp eax, ecx
je 0x1007298d
mov edx, dword [esi + 0x30]
push edx
lea ecx, [edi + 0x38]
push ecx
call eax
add esp, 8
xor ebx, ebx
mov edi, dword [edi + 0x18]
cmp edi, ebx
jne 0x10072928
mov edx, dword [esi + 0x18]
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], ebx
mov ebx, esi
mov dword [esi + 0x14], edx
call fcn.10071ff0
mov byte [esi + 5], 0
mov byte [esi + 0xa], 1
xor ebx, ebx
mov eax, dword [esi + 0x58]
push ebx
push eax
call fcn.1007dac0
add esp, 8
pop edi
mov dword [esi + 0x3c], ebx
mov byte [esi + 0xa], 0
mov dword [esi + 0x14], 0xffffffff
pop ebx
pop esi
ret
cmp byte [esi + 0xf], bl
je 0x10072a37
cmp byte [esi], bl
je 0x10072a37
mov al, byte [esi + 0xb]
test al, al
je 0x100729f4
cmp al, 0xd
je 0x100729f4
cmp cl, 4
jb 0x100729b3
mov eax, esi
call fcn.10071c20
jmp 0x100729b3
cmp cl, 2
jne 0x10072a0b
call fcn.100704d0
mov ebx, eax
call fcn.10071990
test ebx, ebx
jne 0x10072a14
jmp 0x10072a12
mov eax, esi
call fcn.10071c20
mov ebx, eax
mov dword [esi + 0x14], 0xffffffff
cmp ebx, 0xd
je 0x10072a2f
cmp ebx, 0xa
je 0x10072a2f
cmp ebx, 0xb
je 0x10072a2f
cmp ebx, 0xf
jne 0x100729b1
mov byte [esi + 0xb], bl
jmp 0x100729b1
call fcn.10071990
mov dword [esi + 0x14], 0xffffffff
jmp 0x100729b3
Function at 0x100777a0
Capabilities:
Reference sql statements

Disassembly:
cmp edi, 2
jge 0x100777ab
mov eax, 0x17
ret
movzx ecx, byte [ebx]
movzx eax, byte [ebx + edi - 1]
movzx eax, byte [eax + 0x100ae7f0]
movzx edx, byte [ecx + 0x100ae7f0]
add edx, edx
lea eax, [eax + eax*2]
add edx, edx
xor eax, edx
xor eax, edi
cdq
mov ecx, 0x7f
idiv ecx
push esi
movzx esi, byte [edx + str.Pk_]
dec esi
js 0x10077811
nop
movzx edx, byte [esi + 0x100b0af0]
cmp edx, edi
jne 0x10077807
movzx eax, word [esi*2 + 0x100b0b68]
push edi
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHEREVIRTUAL
push ebx
push eax
call fcn.10054330
add esp, 0xc
test eax, eax
je 0x10077818
movzx esi, byte [esi + 0x100b0a78]
dec esi
jns 0x100777e0
mov eax, 0x17
pop esi
ret
movzx eax, byte [esi + 0x100b0c58]
pop esi
ret

Function at 0x10078f10
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10078f20
xor eax, eax
pop edi
pop ebp
ret
push esi
push 1
push 0x44
call fcn.10054d50
mov esi, eax
add esp, 8
test esi, esi
jne 0x10078f37
pop esi
pop edi
pop ebp
ret
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov ecx, dword [edi]
push ecx
call fcn.10078790
mov dword [esi], eax
mov edx, dword [edi + 0xc]
push edx
call fcn.10078e00
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
push eax
call fcn.10079720
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
push ecx
call fcn.10078790
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x18]
push edx
call fcn.10079720
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
push eax
call fcn.10078790
mov dword [esi + 0x1c], eax
movzx ecx, byte [edi + 4]
mov byte [esi + 4], cl
mov edx, dword [edi + 0x20]
push edx
call fcn.10078f10
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x28]
push eax
call fcn.10079720
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
push ecx
call fcn.10079720
mov dword [esi + 0x2c], eax
add esp, 0x24
or eax, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dl, byte [edi + 6]
mov byte [esi + 6], dl
movzx ecx, byte [edi + 7]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov byte [esi + 7], cl
mov word [esi + 8], 0
mov dword [esi + 0x24], 0
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10080920
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x1008fdd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100a3828
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100c66d0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x100c66d0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
cmp dword [esi + 0x78], ecx
jne 0x1008fead
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x1008fead
mov ecx, dword [esi + 0x84]
cmp dword [ecx - 4], edi
jle 0x1008fead
mov eax, dword [eax + 0x18]
test al, 3
jne 0x1008fe4b
test eax, 0x1000000
je 0x1008fead
push str.Cant_terminate_a_sub_expression_with_an_alternation_operator_.
lea ecx, [esp + 0x18]
call fcn.10003d80
mov edi, dword [esi + 0x64]
sub edi, dword [esi + 0x5c]
xor eax, eax
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov dword [esp + 0x64], eax
mov byte [ecx], al
lea eax, [esp + 0x3c]
push eax
call fcn.100058a0
push edi
push 0x11
mov ecx, esi
call fcn.1008f160
cmp dword [esp + 0x28], 0x10
jb 0x1008fea6
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1003d468
add esp, 4
xor al, al
jmp 0x1008ff2e
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x1008ff2c
mov eax, dword [esi + 0x84]
cmp dword [eax - 4], edi
jle 0x1008ff2c
mov edx, dword [eax - 4]
cmp dword [esi + 0x80], eax
je 0x1008fee0
add eax, 0xfffffffc
mov dword [esi + 0x84], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x13c]
mov ebx, dword [eax + 0x140]
sub ebx, ecx
add ebx, 3
and ebx, 0xfffffffc
add ebx, ecx
mov dword [eax + 0x140], ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
mov eax, dword [eax + 0x13c]
sub ecx, edx
mov dword [eax + edx + 8], ecx
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
test ecx, 0xfffffffc
jne 0x1008fec1
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1003c5b5
add esp, 0x30
ret 4
Function at 0x1009eeb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x100b6252
mov dword [esp], eax
mov dword [esp + 4], 0x100b5c24
mov dword [esp + 8], 0x100af124
mov dword [esp + 0xc], 0x100b5c20
mov dword [esp + 0x10], 0x100ae0f4
mov dword [esp + 0x14], 0x100b67e4
mov dword [esp + 0x18], 0x100ab388
mov dword [esp + 0x1c], 0x100ae11c
mov dword [esp + 0x20], 0x100b17fc
mov dword [esp + 0x24], str.___:
mov dword [esp + 0x28], 0x100baac8
mov dword [esp + 0x2c], 0x100ae0f0
mov dword [esp + 0x30], 0x100b647c
mov dword [esp + 0x34], 0x100b5c1c
mov dword [esp + 0x38], 0x100ae120
mov dword [esp + 0x3c], 0x100baacc
mov dword [esp + 0x40], 0x100b6810
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x100b591c
mov dword [esp + 0x4c], 0x100b59d8
mov dword [esp + 0x50], 0x100ae10c
mov dword [esp + 0x54], 0x100ae104
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x100b5c0c
mov dword [esp + 0x64], 0x100b5c08
mov dword [esp + 0x68], 0x100ba7d0
mov dword [esp + 0x6c], 0x100baac4
mov dword [esp + 0x70], 0x100ab418
mov dword [esp + 0x74], 0x100b5914
mov dword [esp + 0x78], 0x100b58f4
mov dword [esp + 0x7c], str.rwa
mov dword [esp + 0x80], 0x100b58e0
mov dword [esp + 0x84], 0x100b58d8
mov dword [esp + 0x88], 0x100b58d4
mov dword [esp + 0x8c], 0x100b04f0
mov dword [esp + 0x90], 0x100baad4
mov dword [esp + 0x94], 0x100ab924
mov dword [esp + 0x98], 0x100bab98
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x100bab94
mov dword [esp + 0xc0], 0x100b59a4
mov dword [esp + 0xc4], 0x100b5988
mov dword [esp + 0xc8], 0x100ab394
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x100b59cc
mov dword [esp + 0xd4], 0x100ae144
mov dword [esp + 0xd8], 0x100b58ec
mov dword [esp + 0xdc], 0x100b59a8
mov dword [esp + 0xe0], 0x100b59b0
mov dword [esp + 0xe4], 0x100b5c04
mov dword [esp + 0xe8], 0x100b59bc
mov dword [esp + 0xec], 0x100b59a0
cmp cl, 0x3c
jae 0x1009f0cd
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x701ff6
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
mov ch, 0x95
rdtsc
lea esp, [esp + 1]
xchg dword [esp + 4], ebx
jmp 0x701fb6