joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a8c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x41a91e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x41a8e0
mov eax, dword [edi]
jmp 0x41aa09
cmp eax, 0x4e0
jb 0x41aa09
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41a940
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41a990
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41fdf0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x14], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x41ff21
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, esi
mov dword [ebp - 0xc], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.0041f780
mov edx, dword [edi + 4]
lea eax, [esi - 1]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], esi
mov edx, dword [edx]
cmp edx, ebx
je 0x41fefc
mov ecx, edx
movzx eax, byte [ecx + 8]
mov esi, dword [edi + 0x18]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul eax, eax, 0x1000193
and esi, eax
mov eax, dword [edi + 0xc]
mov edi, dword [eax + esi*8]
lea ebx, [eax + esi*8]
mov dword [ebp - 8], ebx
cmp edi, dword [ebp - 0xc]
jne 0x41fe80
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
jmp 0x41feee
mov eax, dword [ebx + 4]
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 8]
jne 0x41feba
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp eax, ecx
je 0x41feb5
mov edi, dword [ecx + 4]
mov ebx, dword [ebp - 0x10]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ebx + 4], esi
mov ebx, dword [ebp - 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov dword [ebx + 4], ecx
jmp 0x41feee
mov esi, eax
cmp edi, eax
je 0x41fed1
mov bl, byte [ecx + 8]
mov eax, dword [eax + 4]
mov esi, eax
cmp bl, byte [eax + 8]
je 0x41ff05
cmp edi, eax
jne 0x41fec3
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, edx
mov edi, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x41fe52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ecx + 4]
mov ebx, dword [eax]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], ebx
mov eax, dword [ebx + 4]
mov dword [eax], ecx
mov dword [ebx + 4], esi
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
jmp 0x41feee
push str.invalid_hash_bucket_count
call fcn.004dc13e
int3
Function at 0x426970
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5023b2
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x540020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1a4], edi
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.EngineCore::RouterClient3.0
push 2
mov dword [ecx], 0
push 0x522e08
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.0040a7b0
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1a4], ecx
push 2
mov dword [ecx], 0
push 0x522e08
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.0040a7b0
lea esi, [edi + 0x38]
mov byte [ebp - 4], 2
push 1
mov dword [ebp - 0x1a4], esi
lea ecx, [esi + 8]
push 0
mov byte [esi], 0x2f
call fcn.00428f80
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [edi + 0xa0], 0xffffffff
mov dword [edi + 0xa4], 0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0xf
mov byte [edi + 0xa4], 0
mov byte [ebp - 4], 4
lea esi, [edi + 0xbc]
mov dword [ebp - 0x1a4], esi
push 0xc
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ddc2c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi], eax
mov byte [ebp - 4], 5
push 0xc
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.004ddc2c
push 2
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 8], eax
lea eax, [esi + 0x1c]
push eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.004dce2c
add esp, 0x10
mov word [edi + 0x108], 0
mov byte [edi + 0x10a], 0
mov byte [edi + 0x10b], 0
mov dword [edi + 0x134], 0
lea esi, [edi + 0x138]
mov dword [ebp - 0x1a4], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x426b1d
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov dword [edi + 0x184], 0
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x426b4e
push str.Failed_to_initialize_windows_socket_subsystem_
call fcn.00426720
add esp, 4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x426b66
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ddc19
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x426d80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x540020]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xa0]
cmp eax, 0xffffffff
je 0x426db7
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0xa0], 0xffffffff
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
mov word [esp + 0x10], ax
lea eax, [esp + 0x14]
push eax
push edi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xa0], eax
cmp eax, 0xffffffff
jne 0x426e26
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push edi
push str.Unable_to_create_socket_for__s:_u
call fcn.00426720
add esp, 0xc
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004ddc19
mov esp, ebp
pop ebp
ret 0xc
push 0x10
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x426e70
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push edi
push str.Connect_to__s:_u_failed_
call fcn.00426720
add esp, 0xc
mov byte [esi + 0x108], 0
mov byte [esi + 0x10b], 0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004ddc19
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0x8004667e
push dword [esi + 0xa0]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push ecx
mov ecx, esi
call fcn.00427260
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.004ddc19
mov esp, ebp
pop ebp
ret 0xc
Function at 0x427f80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50254d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x540020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0xd8]
push esi
call fcn.004dce4d
add esp, 4
test eax, eax
jne 0x4280d6
mov eax, dword [edi + 0xd4]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x428026
mov eax, dword [edi + 0xc4]
mov edx, dword [eax]
mov ebx, dword [edx + 8]
test ebx, ebx
jne 0x427fe8
mov dword [edi + 0xcc], ebx
mov dword [ebp - 0x14], ebx
jmp 0x428032
mov ecx, dword [edx]
dec dword [edi + 0xc8]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.004ddd71
mov dword [edi + 0xcc], ebx
add esp, 8
mov eax, dword [ebx + 0x10]
mov dword [edi + 0xd4], eax
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x10], eax
jb 0x428020
mov ebx, dword [ebx]
mov dword [edi + 0xd0], ebx
mov eax, dword [edi + 0xd0]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push esi
call fcn.004dce72
add esp, 4
push 0
push ebx
push dword [ebp - 0x14]
push dword [edi + 0xa0]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jns 0x428067
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
add edi, 0xbc
mov dword [ebp - 0x14], esi
call fcn.004dce4d
add esp, 4
test eax, eax
jne 0x4280dc
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x18]
cmp ebx, eax
jbe 0x428090
mov dword [edi + 0x18], 0
jmp 0x428097
sub eax, ebx
mov dword [edi + 0x18], eax
jne 0x4280b9
cmp dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
je 0x4280b9
mov eax, dword [edi]
mov ecx, edi
push ebx
push dword [eax]
call fcn.00429360
mov dword [ebx], 0
mov dword [edi + 0x14], 0
push esi
call fcn.004dce72
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.004dcade
push eax
call fcn.004dcade
int3
Function at 0x45ddc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.0042c4a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x45ddf0
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x540ab4], 0
mov edi, dword [ebp + 8]
je 0x45de3a
mov eax, dword [0x540bb4]
test eax, eax
je 0x45de13
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x45de3a
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x42f490
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.004eb3e4
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x45de47
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x45de60
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, ecx
mov dword [ebp - 8], edx
push edi
mov esi, edx
mov dword [ebp - 0xc], eax
xor ebx, ebx
cmp dword [eax + 0x14], ebx
jle 0x4729b0
nop
mov edx, dword [ebp + 8]
mov edi, ebx
xor edi, 1
cmp ebx, 2
cmovge edi, ebx
test edx, edx
je 0x4729f5
mov eax, dword [eax + 0x10]
mov ecx, edi
add ecx, ecx
mov esi, edx
mov eax, dword [eax + ecx*8]
mov dword [ebp - 4], eax
mov al, byte [edx]
movzx ecx, al
movzx edx, byte [ecx + 0x515a20]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx]
movzx ecx, byte [ecx + 0x515a20]
sub edx, ecx
jne 0x4729a4
mov ecx, dword [ebp - 4]
sub ecx, esi
mov dword [ebp - 4], ecx
nop word [eax + eax]
test al, al
je 0x4729ef
movzx ecx, byte [ecx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x515a20]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x515a20]
sub ecx, edx
mov ecx, dword [ebp - 4]
je 0x472980
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc ebx
cmp ebx, dword [eax + 0x14]
jl 0x472930
mov dl, byte [esi]
movzx eax, dl
cmp byte [eax + 0x515a20], 0x73
jne 0x4729e6
mov edi, str.sqlite_master
sub edi, esi
test dl, dl
je 0x472a16
movzx eax, byte [edi + esi + 1]
inc esi
movzx ecx, byte [eax + 0x515a20]
mov dl, byte [esi]
movzx eax, dl
movzx eax, byte [eax + 0x515a20]
sub eax, ecx
je 0x4729c5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
add edi, edi
push 0
mov edx, esi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.00431190
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x4729e8
jmp 0x4729a7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
push dword [ebp + 8]
call fcn.0042fe20
add esp, 8
test eax, eax
jne 0x4729e6
mov eax, dword [ebp - 0xc]
mov esi, str.sqlite_temp_master
mov dword [ebp - 8], esi
jmp 0x472923
Function at 0x472bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 0x14], eax
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x472ca5
push ebx
push esi
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x472c86
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x515a20]
movzx ecx, al
movzx ecx, byte [ecx + 0x515a20]
sub ecx, edx
jne 0x472c71
sub ebx, esi
test al, al
je 0x472c86
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x515a20]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x515a20]
sub ecx, edx
je 0x472c50
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x472c11
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x18
push 0
call fcn.00431190
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x472c7d
jmp 0x472c74
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4c5cf0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5030cd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x540020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], 1
call fcn.004c5a60
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov dword [esi + 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], vtable.clara::detail::ResultValueBase_class_clara::detail::ParseState_.0
mov dword [esi + 8], eax
lea eax, [ebp - 0x20]
push eax
call fcn.004c5a60
mov dword [esi], vtable.clara::detail::BasicResult_class_clara::detail::ParseState_.0
lea ecx, [ebp - 0x18]
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], 0
call fcn.004cc220
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ca980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503a0d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x540020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 2
mov dword [ebp - 0x18], edi
push edi
mov dword [ebp - 0x14], edi
call fcn.004dce2c
mov dword [ebp - 4], 0
push 0x30
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.004ddc2c
lea esi, [edi + 0x38]
push 2
push esi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x30], eax
call fcn.004dce2c
lea eax, [esi + 0x30]
push eax
call fcn.004dcfd5
mov byte [esi + 0x58], 0
mov byte [edi + 0x94], 1
push 8
mov dword [ebp - 4], 1
call fcn.004ddc2c
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], 0x4c9240
lea esi, [edi + 0x9c]
mov byte [ebp - 4], 2
push esi
push 0
push eax
push 0x4cfd90
push 0
push 0
call fcn.004eb3e4
add esp, 0x34
mov dword [edi + 0x98], eax
test eax, eax
je 0x4caa60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ddc19
mov esp, ebp
pop ebp
ret
push 6
mov dword [esi], 0
call fcn.004dcb0b
int3

Function at 0x4d6840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504a3d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x540020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 4], 0x4444444
mov eax, dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
je 0x4d6938
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
push 0x3c
mov dword [ebp - 0x14], 0
call fcn.004ddc2c
mov ecx, dword [edi]
mov edx, eax
add esp, 4
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
movups xmm0, xmmword [edi + 4]
mov ecx, dword [ebp - 0x10]
movups xmmword [edx + 0xc], xmm0
movq xmm0, qword [edi + 0x14]
movq qword [edx + 0x1c], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edx + 0x24], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
movups xmm0, xmmword [edi + 0x1c]
movups xmmword [edx + 0x24], xmm0
movq xmm0, qword [edi + 0x2c]
movq qword [edx + 0x34], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
inc dword [esi + 4]
mov eax, dword [ecx + 4]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov dword [ecx + 4], edx
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.list_too_long
call fcn.004dc13e
int3
Function at 0x4d9210
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x540020]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
cmp dword [edi + 4], 0
jne 0x4d923f
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddc19
mov esp, ebp
pop ebp
ret 4
mov eax, dword fs:[0x2c]
push esi
push ecx
push str.SELECT_count___FROM_sqlite_master_WHERE_typetable_AND_name_s
mov eax, dword [eax]
lea esi, [eax + 0x10]
push esi
push 0x10000
call fcn.0042f190
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x4d92b0
push esi
push dword [edi + 4]
call fcn.00488d00
add esp, 0x24
mov edx, eax
mov ecx, str.SetExists
call fcn.004d9140
cmp dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
setg al
xor ecx, ebp
pop esi
pop edi
call fcn.004ddc19
mov esp, ebp
pop ebp
ret 4

Function at 0x4d9330
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504d85
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x540020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 4], 0
jne 0x4d9371
xor bl, bl
jmp 0x4d93fe
mov eax, dword fs:[0x2c]
push str.SELECT_name_FROM_sqlite_master_WHERE_typetable
mov eax, dword [eax]
lea esi, [eax + 0x10]
push esi
push 0x10000
call fcn.0042f190
add esp, 0xc
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x40]
call fcn.004da150
push 0
lea eax, [ebp - 0x40]
push eax
push 0x4d9440
push esi
push dword [edi + 4]
call fcn.00488d00
add esp, 0x14
mov edx, eax
mov ecx, str.ForEachSet
call fcn.004d9140
test al, al
jne 0x4d93dd
cmp byte [ebp - 0x18], al
je 0x4d93dd
mov bl, 1
jmp 0x4d93df
xor bl, bl
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4d93fe
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x4d9416
mov esi, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ddc19
mov esp, ebp
pop ebp
ret 0x28

Function at 0x4f141c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f1292

Function at 0x4f8bc4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f8717
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x27c130aa
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x33dd5fe8
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219