joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d20
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b0c6
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x410018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.____START_POINT_BLANK___AUTO_INJECT_n
push eax
call fcn.00401f50
add esp, 8
xor ebx, ebx
cmp dword [0x41351c], ebx
jne 0x403d63
call fcn.00402860
cmp eax, 0xffffffff
je 0x403d63
call fcn.00402d30
push eax
push ebx
push 0x1fffff
mov dword [ebp - 0x154], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x118]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x118]
mov dword [ebp - 0x13c], 0xf
mov dword [ebp - 0x140], ebx
mov byte [ebp - 0x150], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403dc0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x118]
lea esi, [ebp - 0x150]
call fcn.00408250
push str.GS.mentah
mov edx, esi
push edx
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 4], ebx
call fcn.004086e0
add esp, 0xc
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x134]
mov esi, 0x10
cmp dword [ebp - 0x120], esi
jae 0x403e13
lea edx, [ebp - 0x134]
mov ecx, dword [ebp - 0x154]
call fcn.004031d0
test al, al
je 0x403e81
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.___OK_Boskuh______n
push ecx
call fcn.00401f50
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 8
mov dword [0x41351c], 1
cmp dword [ebp - 0x120], esi
jb 0x403e5a
mov edx, dword [ebp - 0x134]
push edx
call edi
add esp, 4
mov dword [ebp - 0x120], 0xf
mov dword [ebp - 0x124], ebx
mov byte [ebp - 0x134], bl
cmp dword [ebp - 0x13c], esi
jb 0x403ec5
mov eax, dword [ebp - 0x150]
push eax
jmp 0x403ec0
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp - 0x120], esi
jb 0x403e9b
mov ecx, dword [ebp - 0x134]
push ecx
call edi
add esp, 4
mov dword [ebp - 0x120], 0xf
mov dword [ebp - 0x124], ebx
mov byte [ebp - 0x134], bl
cmp dword [ebp - 0x13c], esi
jb 0x403ec5
mov edx, dword [ebp - 0x150]
push edx
call edi
add esp, 4
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ac28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x410018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x408092
cmp byte [ebx + 0x49], 0
je 0x408092
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x408086
lea esi, [ebp - 0x2c]
call fcn.004077b0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x407f73
lea edx, [ebp - 0x2c]
mov eax, edx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
push ecx
mov ecx, dword [ebx + 0x44]
push eax
lea eax, [ebx + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x407fab
dec eax
je 0x407faf
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x40808d
call fcn.00405e30
xor al, al
jmp 0x408094
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x407fbf
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x407fed
cmp edi, 0x10
jae 0x407fce
lea eax, [ebp - 0x2c]
mov edx, dword [ebx + 0x54]
push edx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40807e
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x40808a
test esi, esi
jne 0x407f67
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x4080af
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x4080af
cmp edi, esi
jae 0x408067
push ecx
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.00408430
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x407f67
mov ecx, eax
cmp edi, 0x10
jae 0x408043
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x40805e
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x407f61
test esi, esi
jne 0x408039
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x408076
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x407f61
lea esi, [ebp - 0x2c]
call fcn.00405e30
xor al, al
jmp 0x408094
lea esi, [ebp - 0x2c]
call fcn.00405e30
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409fb6
mov esp, ebp
pop ebp
ret
push str.string_too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x409e40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40aff8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x410018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x409ea3
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.00409c00
mov ecx, esi
call fcn.00409cb0
mov ecx, edi
mov ebx, esi
call fcn.00409d90
cmp dword [ebp + 0x1c], 0x10
jb 0x409ed2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409fb6
mov esp, ebp
pop ebp
ret

Function at 0x409fb6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410018]
jne 0x409fc0
repz ret
jmp fcn.0040a3d3
Function at 0x10040520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x2bb76d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 3
mov byte [ebp - 0x1e], 0x8a
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 3
mov byte [ebp - 0x1b], 0xff
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 5
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0xc
mov byte [ebp - 0x15], 0x29
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x56
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0xf2
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x53
mov byte [ebp - 8], 0xff
mov byte [ebp - 7], 0xff
mov byte [ebp - 6], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x100405d3
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x100405d3
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x100405d3
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x100405d3
mov al, 1
jmp 0x10040695
mov dword [ebp - 0x24], 0
jmp 0x100405e5
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x20]
cmp ecx, 0xff
je 0x1004063f
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x20]
cmp eax, edx
jne 0x1004063d
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x24]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x1f]
cmp ecx, eax
jne 0x1004063d
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x24]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x1e]
cmp edx, ecx
jne 0x1004063d
mov al, 1
jmp 0x10040695
jmp 0x100405dc
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
test eax, eax
jne 0x10040678
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x30
jne 0x10040678
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
test ecx, ecx
jne 0x10040678
call fcn.1006b790
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x10040678
mov al, 1
jmp 0x10040695
push 6
push 0x2b90d8c
mov edx, dword [ebp + 8]
push edx
call fcn.100ce760
add esp, 0xc
test eax, eax
jne 0x10040693
mov al, 1
jmp 0x10040695
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cdbfc
mov esp, ebp
pop ebp
ret
Function at 0x10053400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x2bb76d0]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [0x2b8f320]
push 0x2bc04b0
lea ecx, [ebp - 0x118]
push ecx
call fcn.100cdd60
add esp, 8
push 0x2b91ba4
lea edx, [ebp - 0x118]
push edx
call fcn.100d1b5f
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005345a
xor eax, eax
jmp 0x100534ca
mov dword [ebp - 8], 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.100d1f8e
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.100d1e99
add esp, 4
cmp eax, 4
jne 0x100534a6
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.100d1f8e
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 1
push 4
lea ecx, [ebp - 8]
push ecx
call fcn.100d1a80
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.100d1768
add esp, 4
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100534c7
lea ecx, [ebp - 0x118]
push ecx
call dword [0x2b8f330]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100cdbfc
mov esp, ebp
pop ebp
ret
Function at 0x100932f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
movzx eax, byte [0x2bc5860]
test eax, eax
je 0x10093307
jmp 0x100933b5
mov dword [ebp - 8], 0x80000000
mov byte [ebp - 2], 0x80
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0x80
jmp 0x1009332b
mov cl, byte [ebp - 0xd]
shr cl, 1
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x10093375
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 0xd]
and eax, ecx
je 0x1009334b
mov edx, dword [ebp - 0xc]
xor edx, 0x80000000
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x80000000
je 0x1009336b
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
xor edx, 0x4c11db7
mov dword [ebp - 0xc], edx
jmp 0x10093373
mov eax, dword [ebp - 0xc]
shl eax, 1
mov dword [ebp - 0xc], eax
jmp 0x10093323
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10093060
add esp, 4
mov esi, eax
mov dl, byte [ebp - 1]
push edx
call fcn.10093440
add esp, 4
movzx eax, al
mov dword [eax*4 + 0x2bc5460], esi
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x10093316
mov byte [0x2bc5860], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10093500
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
mov dword [edx + 0x1380], 1
jmp 0x1009353c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1380]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x1380], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1380], 0x270
jge 0x1009358e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1380]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1380]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx*4 - 4]
shr ecx, 0x1e
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 4]
imul ecx, ecx, 0x6c078965
mov edx, dword [ebp - 8]
add ecx, dword [edx + 0x1380]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1380]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4], ecx
jmp 0x10093527
mov esp, ebp
pop ebp
ret 4
Function at 0x40c443
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestMaybe.exe_gMozillaPoisonSize], eax
call fcn.00409eb2
pop ecx
mov ecx, dword [sym.TestMaybe.exe_gMozillaPoisonSize]
mov dword [sym.TestMaybe.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40c47b
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMaybe.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748
Function at 0x4057de
Capabilities:
Reference sql statements

Disassembly:
push 0x18
mov eax, 0x43a563
call fcn.00422500
xor edi, edi
lea ecx, [ebp - 0x18]
push str.SELECT_Value_FROM_Property_WHERE_Property.Property
mov dword [ebp - 0x24], edi
call fcn.0040194d
mov esi, 0x43ee40
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x18]
call fcn.00403dd6
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00403dff
push esi
lea ecx, [ebp - 0x18]
call fcn.00403dd6
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
call fcn.0040bacc
test eax, eax
je 0x405881
call fcn.0040c68d
mov ecx, dword [ebp + 8]
push eax
call fcn.004012cf
cmp dword [ebp - 0x10], 0
je 0x405860
push dword [ebp - 0x10]
call fcn.0040ba8c
cmp dword [ebp - 0x14], 0
je 0x40586e
push dword [ebp - 0x14]
call fcn.0040ba8c
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401856
mov eax, dword [ebp + 8]
jmp 0x405951
push edi
push dword [ebp - 0x14]
call fcn.0040badc
test eax, eax
jne 0x405844
cmp dword [ebp - 0x10], eax
je 0x40589b
push dword [ebp - 0x10]
call fcn.0040ba8c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push dword [ebp - 0x14]
call fcn.0040baec
test eax, eax
jne 0x405844
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
push eax
push 1
push dword [ebp - 0x10]
call fcn.0040bb0c
cmp dword [ebp - 0x1c], 0
je 0x405844
call fcn.0040c68d
push eax
lea ecx, [ebp + 0x10]
call fcn.004012cf
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp + 0x10]
inc eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], eax
inc eax
push eax
call fcn.004017e6
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 1
push dword [ebp - 0x10]
call fcn.0040bb0c
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.00401872
mov esi, dword [ebp + 0x10]
add esi, 0xfffffff0
push esi
call fcn.004013b4
mov edi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, esi
mov dword [edi], eax
call fcn.00401856
cmp dword [ebp - 0x10], 0
je 0x405936
push dword [ebp - 0x10]
call fcn.0040ba8c
cmp dword [ebp - 0x14], 0
je 0x405944
push dword [ebp - 0x14]
call fcn.0040ba8c
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401856
mov eax, edi
call fcn.004224ce
ret 0xc
Function at 0x409910
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ad58
mov eax, dword fs:[0]
push eax
mov eax, 0x1040
call fcn.00423450
mov eax, dword [0x4535a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
mov esi, dword [ebp + 8]
call fcn.00401451
xor ecx, ecx
lea eax, [ebp - 0x1044]
push eax
push ecx
push dword [esi]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1044], ecx
call fcn.0040bafc
test eax, eax
jne 0x409ab5
push str.SELECT__Message__FROM__Error__WHERE_Error.Error
lea ecx, [ebp - 0x1048]
call fcn.0040194d
push 9
xor eax, eax
mov byte [ebp - 4], 1
pop ecx
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
push 0xa
push 0x14
stosw word es:[edi], ax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0xc]
call fcn.004238c6
add esp, 0x10
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x1048]
push eax
call fcn.00403dd6
xor esi, esi
mov dword [ebp - 0x103c], esi
lea eax, [ebp - 0x1040]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x1048]
mov dword [ebp - 0x1040], esi
push dword [ebp - 0x1044]
call fcn.0040bacc
test eax, eax
jne 0x409a7f
push esi
push dword [ebp - 0x1040]
call fcn.0040badc
test eax, eax
jne 0x409a7f
cmp dword [ebp - 0x103c], eax
je 0x409a10
push dword [ebp - 0x103c]
call fcn.0040ba8c
lea eax, [ebp - 0x103c]
mov dword [ebp - 0x103c], esi
push eax
push dword [ebp - 0x1040]
call fcn.0040baec
test eax, eax
jne 0x409a7f
push 0xffe
mov word [ebp - 0x1038], ax
lea eax, [ebp - 0x1036]
push esi
push eax
call fcn.00421c60
add esp, 0xc
mov dword [ebp - 0x104c], 0x800
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1038]
push eax
push 1
push dword [ebp - 0x103c]
call fcn.0040bb0c
test eax, eax
jne 0x409a7f
lea eax, [ebp - 0x1038]
mov ecx, ebx
push eax
call fcn.00401ec8
cmp dword [ebp - 0x103c], 0
je 0x409a93
push dword [ebp - 0x103c]
call fcn.0040ba8c
cmp dword [ebp - 0x1040], 0
je 0x409aa7
push dword [ebp - 0x1040]
call fcn.0040ba8c
mov ecx, dword [ebp - 0x1048]
lea ecx, [ecx - 0x10]
call fcn.00401856
cmp dword [ebp - 0x1044], 0
je 0x409ac9
push dword [ebp - 0x1044]
call fcn.0040ba8c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421c51
mov esp, ebp
pop ebp
ret
Function at 0x41a6fb
Capabilities:
Encode data using xor

Disassembly:
cmova edi, dword [edx + esi*8 - 1]
in eax, dx
int3
adc al, 0x74
aam 0x7c
jl 0x41a772
cwde
fcomp qword [ebx - 0x3af1571e]
test al, 0xe
invalid
mov bh, 0x73
invalid
test al, 0xe
lds esi, [edi - 0x3966708d]
jp 0x41a6d8
fst st(6)
mov esi, 0x3253873f
pushal
push edx
pop ebx
outsd dx, dword [esi]
out dx, eax
mov esi, 0xe2f1de4c
jle 0x41a75a
jg 0x41a6f1
invalid
test ebp, 0x76cf63d1
hlt
sbb al, 0x9f
mov eax, 0x6b289374
out 0xbb, eax
stosd dword es:[edi], eax
outsb dx, byte [esi]
push ebp
hlt
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10